Cisco VPN :: ASA5505 Blocking Remote Network / Site-to-site Vpn

Jun 28, 2011

I have a site-to-site VPN already established, everything is working as it should.  I'm trying to block the remote network from accessing our network since we only need to access theirs.  I'm sure this is something very easy to implement with an ACL but I'm not sure where this rule needs to go. The VPN is on ASA 5505. 

View 5 Replies


Cisco VPN :: ASA5505 Site-To-Site And Remote Access On Same Device

Jun 3, 2012

I'm attempting to configure an for both site-to-site and remote access VPNs.  The site-to-site is working fine, however when I connect using the Cisco client, after initial connection and password prompt I get a "not connected" status.  The log states that a policy map match could not be found.  I have successfully set the unit up for remote access with no site-to-site and ran into another host of issues when adding the site-to-site to the working remote access config, so I started over setting up site-to-site first.  I've attempted this through ADSM (hate it) - the current configuration is via CLI.  I'm certain I'm just missing a piece or two.

View 2 Replies View Related

Cisco VPN :: ASA5505 Remote VPN Using Site 2 Site VPN

Nov 14, 2011

I have 2 ASA 5505 firewall, Site 2 Site VPN working between two firewall. I attached visio diagram for my senario. I configured IPsec Remote VPN in ASA-01 firewall, a user able connted to ASA-01 network via modem through remote VPN. As i configured site 2 site VPN between two ASA, Is that possible that through remote VPN a user can able to connect to ASA-02.

View 2 Replies View Related

Cisco VPN :: Network-access Between ASA5505 And ASA5510 (site-to-site)

May 9, 2011

we set up a site-to-site-vpn between a 5505 and a 5510 (both asa8.3.1). We configured both sides using the VPN-Wizard in the ASDM. When we try to ping from the network behind the 5505 ( to any host behind the 5510 ( the tunnel gets established but the ping doesn't get trough. After that we tried to connect via RDP to any host behind the 5510 and it worked well (same with ssh, telnet,vnc etc.). Now we want to map a network-share on a 2008-Server behind the 5510 but it's not working. In the ASDM-Log I see some "denied by inside-access in"-messages for the ports 139 and 445. Isn't it right that the whole traffic in the vpn-tunnel bypasses the acl? Even if we open both ports we can't connect to the network-share?

View 1 Replies View Related

Cisco VPN :: ASA5505 - Site-to-Site Ping From One To Other Network Failed

Oct 1, 2012

I just get it that I can make a VPN Site-to-Site IPSec. But if I try to send a ping from one PC (network 1) to the other PC (network 2) it failed.
PC (Network 1) <ASA5505> Switch <ASA5510> PC (Network 2)
between the two ASA I have a funkctional VPN IPSec tunnel, but I can`t get access from one to theother network.
That are the access-list on the ASA5505:
access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096)
alert-interval 300
access-list Inside_ICMP; 4 elements


View 19 Replies View Related

Cisco VPN :: 5510 Site To Site VPN Access To Servers With Overlapped Remote Site

May 18, 2012

I have a requirement to create a site to site vpn tunnel on ASA 5510 from a remote site to my HO, ihave already other site-to-site tunnels are up and running on the ASA.The issue is my remote site has got the network address which falls in one of the subnet used in HO( requirement is only  My remote site need to accees couple of my servers in HO which is in subnet.

View 2 Replies View Related

Cisco VPN :: Remote Client Cannot Connect To Local Network Or Site To Site ASA 5510

Jul 21, 2011

I setup RA-VPN under local asa 5510 IP pool ( and all was working fine. I got internet and local network access.
Then i have 5 site to site VPN working fine but when im traying to access to those L2L VPNs from the remote acces client im not able to do that. So after that i decided to obtain IP addresses from my DHCP server so i can obtain IPs from my local network ( and then access normally to the VPN site to site. But the surprise was that the VPN cisco client is getting local IP address ( perfectly but im not able to access even to my local network.

I have the same-security-traffic permit inter-interface same-security-traffic permit intra-interface enable.

View 6 Replies View Related

Cisco WAN :: 2911 - Site-to-site IPsec Vpn / Unable To Ping Remote Network

Apr 3, 2013

I have two Cisco routers - 2911 in HQ and RV180 in branch office. Because in HQ LAN network I have some development servers, to which guys from branch office need to have acces, I decided to setup VPN site-to-site between HQ and branch office. Everything went quite smoothly, on both devices I see, that ipsec connection is established. Unfortunately I am not able to ping resources from one network to other one and vice versa. Below is the configuration of 2911 router (I skipped som unimportant (imho) configuration directives) :
crypto isakmp policy 1
encr 3des
hash md5


View 9 Replies View Related

Cisco VPN :: ASA 5505 - Users Aren't Able To Reach Remote Network Through Site-to-site Tunnel

May 21, 2011

Remote-access users aren't able to reach our remote network through a site-to-site VPN tunnel between two ASA 5505's.
I've seen several threads about that here, I've run through the walkthrough at [URL] I've taken a stab at setting split tunnelling and nat exemption, but it seems I'm still missing something. Remote-access users can reach the main site, but not the remote site.
Remote-access (vpn-houston) uses
The main site (houston) uses
The remote site (lugoff) uses

View 5 Replies View Related

Cisco VPN :: 5520 Requirement To Terminate Site-to-site VPN From Remote Site

Jun 17, 2012

We have ordered a pair of Cisco ASA5520 (ASA5520-BUN-K9).Now there is a requirement to terminate site-to-site VPN from remote site. Do we need VPN plus licence for this and how much it cost?

View 1 Replies View Related

Cisco VPN :: 877 / How To IPsec Site To Site Vpn Port Forwarding To Remote Site

Jun 13, 2012

The scenario where a Site to Site VPN tunnel has been established between Site A and Site B. Lan on Site A can ping Lan on Site B. My problem is a Printer behind Site B needs to be accessed by using the WAN IP address of Site A. Also i could not ping the remote lan or printer from the router.
Below are my configure on the Cisco 877 in site A.  
Building configuration... 
Current configuration : 5425 bytes
! Last configuration change at 15:09:21 PCTime Fri Jun 15 2012 by admin01
version 12.4
no service pad


View 1 Replies View Related

Cisco VPN :: 5505 - Site To Site Connected But Cannot Ping Remote Site

Oct 11, 2011

cisco products and am struggling getting a VPN going between an ASA 5505 and 5510.  I have a VPN created (using the VPN wizward on both) and it shows the VPN is up, but I can't ping the remote site (from either side).

View 11 Replies View Related

Cisco VPN :: PIX 515 Accessing Remote Network Over Site-To-Site VPN

Sep 14, 2011

I have a PIX 515 and am working with a Site-to-Site VPN.  When I do not specify a filter on the Group Policy I can successfully access the remote network and the remote network can access my local network.  However this by itself poses a securty risk for my local servers.  I need to be able to access the remote network fully, however only one or two workstations on the remote network need to access mine.
If I add access-list vpn-remote-site extended permit ip host remote-wkstn1 any then only the remote workstation can access my remote network.  This gets me a step closer as now only the remote workstation can access my network effectively denying everything else.  However, from my local network I can now only access the remote workstation and not all of the other devices. I do not have any control over the remote firewall and would like to make sure it is secured on my end.

View 1 Replies View Related

Cisco VPN :: ASA 5505 Site To Site Connection / Remote Site?

Mar 6, 2011

i have 2 router asa 5505 with base license i wanna make site to site vpn connection and remote site using vpn client to connect first i have hdsl router with 5 public ip i wanna try it by giving 1 public ip to each router and try the vpn but nothing work?

View 1 Replies View Related

Cisco VPN :: ASA 5510 Implicit Deny Access Rule Blocking Site-to-Site VPN?

Apr 22, 2012

I've setup a site to site vpn on an ASA 5510 using ASDM (as I have many times before) and the tunnel appears to be up but I am not able to pass traffic.  When I run the packet tracer from my inside network to the remote destination network, it shows that it is blocked by the implicit deny ip any any rule on my inside incoming access list.

View 5 Replies View Related

Cisco VPN :: ASA5505 / PIX 515E - How To Get VPN Up From Out Remote Site

Feb 27, 2013

I'm having a Issue getting my VPN up from out remote site . We have a ASA5505 at the remote site and the Main office we have a  PIX-515E.. I followed this temp config I found on line but Im still not able to get the VPN UP..

This script can be used to get you started on a site to site vpn using the older Cisco PIX code. PIX running 6.3 ! ^^^^ Set ISAKMP (phase 1) parameters ^^^^^ {code]... 
When I log into the ASA and run these commands This what I get
Colort2# sh run crypto isakmp
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des

View 1 Replies View Related

Cisco VPN :: ASA5505 - IP Address Pool In IPSec Client And Site-to-site VPN

Jul 10, 2012

We have a scenario where the Cisco ASA 5505 will be one end of a site-to-site VPN. The same ASA 5505 also allows Client VPN connection. The question is around IP pooling. If I assign a pool of IP's ( - for Client VPN connections - do I need to be sure that those same IP's are not used on the other side of site-to-site VPN ?

There could be PC's/Servers running on the other side of site-to-site VPN. Would this cause an address conflict ?

View 4 Replies View Related

Cisco :: Reach To Remote Site Via SSLVPN (ASA5505)

Feb 10, 2011

I'm having some troubles with SSLVPN connectivity. I've setup SSLVPN at one site and it works great with web access, file share, RDP plugin etc. at the local LAN on that site. But I also would like to reach another site (connected with an IPSEC tunnel). Is this possible? if it is, how do I do it?Both firewalls are ASA5505, one 8.31 and one 8.22 Just a note, it works to connect with IPSEC client and reach the remote site just fine.

View 8 Replies View Related

Cisco VPN :: ASA5505 Site-to-Site VPN And AnyConnect On Same Device Using IKEv2

Jul 10, 2012

I have 2 ASA5505's connected through a site-to-site using IKEv1 and IKEv2.Recently, I ran through the wizard to configure the AnyConnect software. [code]Now, my site-to-site connection will only come up using IKEv1.Is there a way to have both the Site-to-Site and the AnyConnect VPN connections use IKEv2?

View 1 Replies View Related

Cisco VPN :: ASA5505 Add Site-to-site Tunnel On Top Of Existing Configuration

May 3, 2011

i have one asa 5505 that have classic remote access vpn set-up and now i need to add site-to-site tunnel on top of the existing configuration. Is that possible with asa 5505 and do i need some special IOS bundle for that? May i use vpn wizard for that or do i need to go through cli since remote access vpn is setup using wizard.

View 2 Replies View Related

Cisco VPN :: Site-to-Site VPN Over PPoE Internet Using ASA5505?

Feb 8, 2011

I have a client that wants to establisha S2S VPN across the Internet.  His Canada site (using an ASA5510) has a traditional fibre Internet service. However, the Chilean side (using an ASA5505) is using a PPoE Internet service.  The Chilean IP is dedicated, but the host IP they've received is the same as the default gateway (odd).Anyway, given that it's a PPoE Internet connection with authentication required, is it even possible to establish a S2S VPN.  I guess I'm thinking that if the Canada side tries to initiate to the Chilean side without anyone on their end to initiate the traffic first (and therefore authenticate in the process), will this even work?

View 1 Replies View Related

Cisco VPN :: ASA5505 Site To Site IPSec VPN Will Not Connect

May 22, 2012

I've spent 2 days already trying to get 2 ASA 5505's to connect using an IPSec vpn tunnel. I cannot seem to figure out what im doing wrong, im using and as my internal networks that i'm trying to connect over a directly connected link on the outside interfaces with and as the addresses (all /24). I also tried with and currently without NAT enabled. Here are the configs for both ASA's, the vpn config was done by the ASDM, however i have also tried the command line apporach with no success. I have followed various guides to the letter online, starting from an empty config and from factory default. I have also tried the 8.4 IOS. [code]

View 2 Replies View Related

Cisco VPN :: Site-to-Site Not Working Between PIX515e And ASA5505

Aug 9, 2011

he IPSec tunnels do not form and I notice the error: 3Aug 09 201105:13:26IP =, Error processing payload: Payload ID: 1 Reading up on this it looks like it might be an IKE problem but I'm struggling to find the cause (the new 8.4 commands not useful).
The setup is as follows:-
Head Office
PIX515e v6.3(4)
Branch Office
ASA5505 v8.4(1)

View 3 Replies View Related

Cisco VPN :: Site To Site Tunnel Is Up But ACL Is Not Working On ASA5505?

Oct 6, 2012

I have configured Site to site and the VPN tunnel is up. But the ACL's are not working.

View 11 Replies View Related

Cisco Security :: ASA5505 Site-to-Site VPN And SLA Monitor

May 13, 2012

I have a couple of ASAs 5505 (HQ & Branch) running version 8.2(4).  They are configured with a Site-to-Site VPN over a single WAN link: [code]

I want to enable sla monitor on one of the devices in order to know the real status of my unique link because the interfaces sometimes don't go down, so I don't have any real statistic of failures. 
All the information is related to dual ISP links failover.  Is there any extra-consideration for my single link scenario?I already have a static route route outside 1 so I think I have to overwrite it with something like this route outside 1 track 1. Is this correct?If so, when I overwrite it, will the S2S VPN go down and will it go up automatically? 

View 1 Replies View Related

Cisco VPN :: ASA5505 Behind D-Link DSL-2640U Site-to-site

Apr 12, 2013

I am normally a software developer,  however with recent staff changes at my company I am now the sole IT  person.We have to sites: A and B, and we need to make a site to site.
I have access only to the Site A, this one contain a ADSL modem/router (D-Link DSL-2640U), and a ASA5505 behind the modem.We have an public fixed IP addresse configured on the modem.All the information that i have to configure the vpn is: Public ip of the site_BThe encryption algorithm 3DES-MD5.Shared secretThe site_B subnetwork to be reached using the vpnAnd i nedd to get this VPN UP, and it must be no nating for pakets going throught the VPN (for maintenance Issus).
The D-link modem is configured to get the Public IP from my ISP, and i set on it a DMZ to the ASA5505 ( now, i folowed the site-to-site assistant using the ASDM. [code]

View 1 Replies View Related

Cisco VPN :: ASA5505 Site To Site VPN Stopped Working

Sep 18, 2012

We have 2 ASA's that connect to a 2811, but for some reason, the 2nd ASA wont connect anymore. Debuging ipsec or isakmp on the 2811 doesn't come up with any messages. 
External IP's still correct, and the sites can ping each other.
Only debug on ASA for crypto isakmp comes up with messages (ipsec doesn't give any messages).
ASDM says:
Removing peer from peer table failed, no match!
Error: Unable to remove PeerTblEntry
I found some info on the above error messages, but those links didn't quite useful.
Below is fromt he debug on the ASA:
Sep 18 22:06:09 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0Sep 18 22:06:09 [IKEv1]: IP = 64.X.X.X, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.Sep 18 22:06:10 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0Sep 18 22:06:10 [IKEv1]: IP = 64.X.X.X, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.Sep 18 22:06:13 [IKEv1 DEBUG]: Pitcher: received a key acquire message, spi 0x0Sep 18 22:06:13 [IKEv1]: IP = 64.X.X.X, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.Sep 18 22:06:16 [IKEv1]: IP = 64.X.X.X, IKE_DECODE RESENDING Message [code]...

View 11 Replies View Related

Cisco VPN :: ASA5505 Tunnel Some Traffic (public Host) From Remote Site

Feb 6, 2012

On remote site I have Cisco ASA5505, on cental site I have Cisco 2811 router, working site-to-site VPN tunnel. [code]

View 1 Replies View Related

Cisco VPN :: Setup ASA5505 Site To Site VPN?

Mar 20, 2013

I need to setup a site to site VPN. Site A has a 5505 running ASA v7.2(4),  this has been in place for a few years and is also used regularly for client  remote access.  For site B i have a brand new 5505 running ASA 8.4(3).Is the ASA version miss match an issue, or should i upgrade site A to the same version as site B? Assuming they should run the same version, which is the best choice to use?  There is a choice of 9.0.2 under latest  releases, then 9.1.1 ED, and 9.1.1(4) interim.

View 1 Replies View Related

Cisco VPN :: ASA5505 Site-to-site VPN Compatibility?

Apr 11, 2012

Does Cisco ASA 5505 is compatible for site-to-site VPN with any of the following devices?
Airlive: RS-1200 Security gateway    Fortinet: Fortigate-60C (FG-60C-BDL)  

View 1 Replies View Related

Cisco VPN :: Deploy A Site To Site VPN Using Two ASA5505?

Feb 6, 2012

We are going to deploy a site to site VPN using two ASA5505.  The network I'm going to traverse has a max MTU of 1320. I determined this by experimenting with pings of different sizes. How should I configure MTU on my ASAs?I'm thinking of using these two commands but I don't know if there are any implications to this...
ip mtu outside 1320
ip mtu inside 1280

View 1 Replies View Related

Cisco VPN :: Set Up Site-to-site VPN Using ASA5505 And Software 8.2

Apr 3, 2012

I'd need to set up site-to-site VPN using ASA 5505 and software 8.2.LAN1 is, LAN2 is particular thing among the others I've ever set up is that I have to show up to LAN1 as, and not as have as NAT extempt rule, in order to make packet travel the ipsec tunnel, but how can I set up a NAT rule in order to modify LAN2 address and show up to LAN1 as 172.16.1.x instead of 10.2.0.x?

View 3 Replies View Related

Cisco VPN :: ASA5505 - Site-2-Site VPN With Linksys In One End?

Sep 25, 2012

Today i'm running with an ASA 5510 at the HQ and a ASA 5505 at my home address with a site-2-site VPN connection.

I'm only using the 5505 to hold this site-2-site VPN so it's a bit overkill. I would like a router at my home with build in access point, but it needs to support site-2-site vpn with the ASA 5510 at the HQ.
Are you aware of any Linksys routers that can hold this VPN connection, or is it only "real" cisco routers/firewalls where this is possible?

View 1 Replies View Related

Copyrights 2005-15, All rights reserved