Cisco VPN :: Unable To Establish Remote Access Connection From Behind ASA 5520?
Jul 16, 2012
We have two sites, Site-A with a ASA 5520 (Remote Access IPSEC VPN server) at one end and a new ASA 5515-X at Site-B. Users at Site-B are unable to establish a VPN connection to Site-A via Cisco VPN client from behind the new ASA 5515-X. They see the following error:
"Secure VPN Connection terminated locally by the client.
Reason 412: The remote peer is no longer responding.
They are able to access the same from home or elsewhere so I believe there is nothing wrong with Site-A ASA vpn config which we have been using for a while now. The new 5515-X (version 8.6) has a very basic config with all outbound traffic allowed. I'm pasting the config below. Do I need to enable/allow anything for it to work?
CISCOASA# sh run: Saved:ASA Version 8.4(3)!hostname CISCOASAenable password xxxxxxxxxxxx encryptedpasswd xxxxxxxxxxxxxx encryptednames!interface Ethernet0/0 nameif outside security-level 0 ip address x.x.x.x 255.255.255.248!interface Ethernet0/1 nameif backup security-level 0 ip address
[Code]....
View 15 Replies
ADVERTISEMENT
Jul 15, 2012
I have a sky router (Netgear DG834GT), which i have connected a secound router to which is a D link DIR-615 (with DD wrt firmware D4).I can get access to the sky router remotely without any issues even when changing the port number. its the Dlink router i cannot get access to remotely (within the network i can by typing in the dlink's ip address and works). Main router Sky router IP is 192.168.0.1 - Currently the port number is 8081.Secondary router Dlink IP is 192.168.0.2 (Static ip) - currently the port number is 8080.I have tried to configure the ports but it just dont want to open. Ive tried to open the ports on main netgear and tried all the option my dlink for port forwarding. i must be missing something fundametal here.
View 2 Replies
View Related
Mar 31, 2011
We have ASA5510 with version 7.x and asdm 5.X, i upgraded it to 8.3 and asdm 6.2, and i got vpn peers 250 and 2 ssl.when i try to connect through client software , i can see in the logs UDP 500 port is created as shown below.Mar 31 2011 23:54:40 302015 94.97.180.0 57013 x.x.x.x 500 Built inbound UDP connection 56694 for outside:94.97.180.0/57013 (94.97.180.0/57013) to identity:x.x.x.x/500 (x.x.x.x/500) no other things are going on , and i get error as shown below.
Secure VPN Connection terminated Locally by the client
Reason 412: Remote peer is no longer Responding
Connection terminated on.
i am suspecting it is VPN-3DES-AES activation key issue.when i go to Remote Access VPN ---Advanced---SSL Seetings--From Left Encryption Panel Available Algorithems i have DES-SHA1 when i try to drag it tto Right panel of Active algorithems it gives me error *** below [ERROR] sl encryption rc4-sha1 des-sha1 The 3DES/AES algorithms require a VPN-3DES-AES activation key and currently in right panel of Active Algorithms i have only RC4-SHA1,
View 4 Replies
View Related
Aug 6, 2012
I Have asa 5520 terminate the remote access VPN Connection,when successfully connect to my corporate Network and try to copy a file(30MB) from the share to my PC ,it takes around 2 Hours or it disconnect.what is the speed of the vpn client once y connected to the corporate over the Internet ?at my home i have 512 ADSL while at my corporate we have 155Mbps Internet speed.
View 1 Replies
View Related
Jul 17, 2012
i am trying to establish a VPN connection between two remote offices.In the home side I have Cisco 1811W and on the far side CiscoSRP541.
What is the best solution to build a site-to-site VPN between those two locations. I originally thought to configure a GRE tunnel on the routers, but faced some issues with that.
View 9 Replies
View Related
Jun 15, 2011
I have WAG120N and I want to use ssh tunneling to browse the net.In windows, I have to use a software like putty or xShell to establish a ssh connection to remote server.It works perfectly and I don't have any problem with it.The problem occurs when I want to use this ssh account in linux.At first,connection established without any problem or error.After 2-3 minutes it seems ssh dies and no data transmitted through ssh tunnel.I tried this with Symphony ADSL modem(Wired only) and I have no problem with it.I want to know if there's any specific problem or configuration for WAG120N to solve this problem?I like this modem/router and I don't want to sell it and buy any other modem/ router.I have to mention that usually I use wired connections to WAG120N,but at some cases I need to use its wireless features.
View 4 Replies
View Related
Sep 6, 2012
I have a RVS4000 with client VPNs setup and have created all 5 users......trouble I run into is that when one of the users attempts to connect to the VPN from a second device (ie the sixth device to connect to the VPN), the connection does not establish....cannot ping remote server (using QuickVPN). In looking at the logs, the device that isn't working is getting a different IP (172.16 vs 192.168). I know I'm limited to 5 users, but am I limited to 5 devices as well?
View 2 Replies
View Related
Sep 28, 2011
I have to unplug/replug my router powercord connection every time i want to use my laptop to access the internet. i have reinstalled the software disc that came with my router. i have have comcast check my modem-
View 2 Replies
View Related
Jan 22, 2012
Purchased E2500 1 week ago. I do not have a problem communicating with the router itself (either hard wired or wireless) but I have been unable to establish a usable internet connection from the router.I live in building that is wired by Restech Services - Ethernet jack in wall - no modem. Connection works just fine if I bypass router and connect directly to PC (windows XP SP3 desktop or windows 7 laptop.),Very difficult to establish any internet connection at all. I have to renew IP address many times or go through re-boot sequence multiple times. Once I get a connection it is unusable. If I attempt to ping a URL (either from PC or from router admin page) it is unable to resolve host. If I ping an IP directly (either from PC or router administrator page) I typically get 60 to 80% packet loss. As noted, if I bypass router and make internet connection directly to PC - no problems - no packet loss.Used Cisco Connect software to set up. On advice of ISP changed MTU from 1500 to 1300. Also registered MAC id with ISP and changed from cloning PC MAC to using the router MAC. Downloaded and installed latest firmware version. Did factory reset and re-configured the whole thing. Double checked and swapped wiring.
View 5 Replies
View Related
Aug 31, 2011
So I've decided to use a different router to resolve some VPN issues, and want to use my DIR-655 as a pure wireless access point. I need the access point to use the same range of IP addresses as the rest of the network (maintain access to networked printers, file shares, etc). However, I can't establish a wireless connection to the access point.
- Defined a IP address for the DIR-655 within the DHCP range of the primary router
- Defined the proper subnet
- Disabled the DHCP server on the DIR-655
- Connect a LAN port of the DIR-655 to a LAN port on a switch (note that it's not connected directly to a router).
When I connect a device WIRED to a LAN port on the DIR-655, everything works fine. The device gets assigned a DHCP address (which I know is being assigned by the main router since the DIR-655 DHCP server is disabled), and I can connect to the LAN and I can access the internet with no problem. So I know the DIR-655 is acting correctly to pass thru traffic. Also, I can access the DIR-655 web configuration page from any LAN device (even a device not directly connected to the DIR-655), so I know the DIR-655 is on that LAN correctly.
But when I try to connect WIRELESS to the DIR-655, it doesn't work at all. Although the wireless NIC is connecting to the DIR-655 (e.g. it asks me for the WPA key), it can't pull an IP address, so there is no connection to the LAN or internet.
View 5 Replies
View Related
Nov 10, 2011
We have a Main ASA 5520 and two remote site ASA 5505's that connect to each other via S2S VPN tunnels. Currently they are doing split tunneling, so only local traffic goes over the tunnel. We have are local LAN (10.0.0.0/16) and our DMZ (10.3.0.0/24) network at the main site. The DMZ hosts our external sharepoint, but we have access to it internally The problem is site A (10.1.0.0/24) and site B (10.2.0.0/24) have no idea of it, and when attempting to go to the site, it fails. You can access it via the external site address, but that's the only way. Normally the external address is blocked when you are internal.What i'm stuck at is even when we had all traffic sent from Site A to our main hub, it still wouldn't find it. Would i have to make a separate vpn tunnel purely for that DMZ traffic?
View 6 Replies
View Related
Jan 22, 2013
I am trying to configure Remote Access VPN in our Cicco ASA 5520 firewall through SSL VPN wizard. I tried to configure Anyconnect VPN client option, but after entering user/pass it gives error "An error was received from the secure gateway in response to the VPN negotiation request. Please contact your network administrator. The following message was received from the remote VPN device: No assigned address"
As looking online there is no easy step-by-step option for same. I want to provide Remote Access VPN to some of our user abroad who should have access to few server applications and no internet access.
View 8 Replies
View Related
Mar 14, 2011
I am trying to build a remote vpn in ASA 5520 Software Version 8.3(1). I am using ASDM 6.3(1) for the configuration. I went through the SSL VPN wizard and did the configuration. I tried connecting to the ASA using anyconnect VPN and I could successfully connect the VPN. My home laptop takes an IP 192.168.60.21 (which I have defined in the wizard). Now my issue is, I can't access any office internal network from this laptop (none of the internal IP is ping ing even). Meanwhile, I could ping and rdp to this laptop(which is connectd by anyconnect VPN) from my office network. One thing I noticed is that when I give a traceroute to an internal IP from the laptop, the first hop goes to my home ISP router.
View 8 Replies
View Related
Mar 19, 2013
We have 2 5520 ASA's working in an active/standby function at our central site. The remote agencies have control of their ASA's or other devices able to create VPN tunnels back to the central site. When a new remote agency wants to connect to our central site we assign them a network range that is routable on the central sites network.We ask that the remote agency NAT into the addresses we provided them.This way we are able to route back to them. We assign the interesting traffic and then they we start communicating by way of the tunnel.
Since the central site can't control the traffic coming in on the site to site tunnel other than just defining the interesting traffic AND we aren't able to control the NAT on the remote end how can I put an access list on the central site ASA to allow only certain ports and IP's by way of access list? Ultimately, I'm trying to limit traffic on the central site coming inbound to only allow traffic I want. I tried applying a group policy to the lan2lan site to site tunnel, but it failed for some reason. It actually prevented all traffic. Can I apply a group policy to a site-to-site tunnel?
I'm struggling here a bit as I don't have control of the remote end. They can NAT whatever they want to an address in the range we assigned them. The tunnels interesting traffic is set to full ip to the central site's destination. The interesting traffic on the central site is set the same. However, on the central side...I want to limit that traffic to only certain ports by way of an acl. If it is possible to assign a site-to-site tunnel a group policy and filtering is done in that method, can
View 3 Replies
View Related
Mar 7, 2011
Is there any documents that I can use to design an IPSEC remote access solution using 2 data centers . One data center is primary and other one is secondary. The VPN is terminated in ASA 5520. End users using cisco client.
View 6 Replies
View Related
Jan 25, 2013
I have Cisco ASA 5520 / ASA Ver: 8.0(4) / ASDM Ver: 6.1(3). I have configured Remote Access VPN and everything seems to be fine. Like i have created Extended ACL and allowed for singe host with particlar port to be allowed.
After login with the Anyconnect client, i am restricted to access the single host configured, but not based on ports. i.e. i do not want user to RDP the server allowed, but only access the application based on the port that is allowed. But somehow it is not working.
how can i allow user to access a server with defined port only and not any other service/port access for the server.
View 4 Replies
View Related
Oct 17, 2011
I have a site to site VPN between SiteA to SiteB which is working fine. SiteA has an ASA5520 and SiteB Pix501. The ASA5520 is running version 804 with split tunneling. Users connect to SiteA using remote access VPN. Is it possible to setup SiteA ASA5520 so that when users connect to SiteA they can access servers located on SiteB through the tunnel? I know i can setup the Pix501 for remote access VPN but it is located in another country and i don't want to take a chance just incase i lose connectivity.
View 7 Replies
View Related
Oct 24, 2012
I have an ASA 5520 8.2(3) and allowing my remote client-to-site-vpn clients to access resources directly connected to my ASA on separate lower security interfaces (not the outside) besides just clients on my internal networks. Someone mentioned to me configuring 'VPN on a stick' however from what I've read this seems to be only applicable when it comes to split-tunneling back out the outside interface (could be off on that). Is this possible on other lower security interfaces as well, and if so what would a mock config that accomplishes that look like (acl's, nat, etc)? Also, if I want internal users to be able to connect to these remote clients once they are active, are there any nat statements necessary (such as nonatting them) or are the vpn clients just seen as internal clients from the rest of the internal network's standpoint by default?
View 5 Replies
View Related
Apr 29, 2013
We have dns server(only Internal IP) inside our network, right now we have configured Remote Access VPN using Public IP and we connect it using the same Public IP. I need to use FQDN instead using Public IP. What is the configuration for this.
-Device : ASA 5520
-Configuration Type : IPSec
View 1 Replies
View Related
Apr 14, 2012
I am using asa 5520 and asa 5540 for remote access vpn connections. Is it possible to do active monitoring of my vpn connections so that there would be alerts for vpn tunnels that fail to establish due to other reasons other than user authentication?
View 5 Replies
View Related
Mar 21, 2012
I have configured vpn filtering on all my l2l vpns. I have restricted access from remote to local resources only to specified ports. It works perfectly.But I want to have also full access from local to remote networks (but still preserve restricted access from remote to local). As I now VPN Filter works bi-directional with a single ACL. So is there some way to open all traffic from local to remote and still restrict remote to local traffic? ASA 5520 8.4(3)
View 4 Replies
View Related
Apr 16, 2012
i have cisco ASA5520 and i have a remote access vpn .I want to configure logging for this remote access vpn.
i want the time user connected .how log it is connected .If any error while connecting ?
View 4 Replies
View Related
May 7, 2012
I have created remote access vpn in my ASA 5505. The tunnel is established but i am not able to access the internal network.
View 3 Replies
View Related
May 17, 2011
We have an ASA5510 and a few days ago we were unable to access some segments from remote access VPN, the problem was not the config. A few hours later the problem was resolved on its own and I suspect we have an IOS bug. This has happened a few times in the past and its becoming an issue. How can this be confirmed and which IOS should we upgrade to? Prefer not 8.3 given the syntax difference
View 1 Replies
View Related
Oct 2, 2012
I have remote branches that connect to the corporate office as a site-to-site VPN. Now the clients at the branch are getting an application that is using an unsecured port (tcp/23). I would like to use a set of ASA 5520's that I have at the corporate office, with the AnyConnect license on them. I want the client machines to establish a tunnel from the client to one of these ASA's. The ASA' then would have a connection to the VLAN that the receiving server is housed on. The trick is to just establish the tunnel from the client to the ASA that will allow the IP of the client to not be translated. So I would use the ASA as a security 'pass-through' for the clients that use this new application.
View 1 Replies
View Related
Mar 16, 2012
Device asa 5550 - But can a Client establish a SSL VPN to remote network and devices on the remote network access local network printers? so you got one client one network A that creates a SSL VPN to network B , can network B be configured so that automatic job come across the same ssl vpn to a Different IP?
View 5 Replies
View Related
Apr 28, 2012
I'm dessigning a network and this is my scenario:
5 - Remote sites (no static IP there)
3 - Remote users (comercial)
1 - Central building (using static ip address)
Is it possible to establish a permanent vpn tunnel between each one of my remote sites to the main building, even if I have no static IP address in the remote sites?
Do you think that RV180 is the best choice to mannage vpn connection between remote sites and the central building securely and faster?
View 2 Replies
View Related
May 27, 2012
I have an issue where my vpn clients are unable to access certain vlans in my network.I have configured an ASA 5520 with VPN access using the wizard and using the ASA as a dhcp server for VPN clients. I find that this allows the clients to access server resources such as the Exchange and Domain Controller but I find that these vpn clients are unable to ping each other as well as certain vlans that I have.Is there a way to configure the ASA to use a particular vlan that is already configured on the core switches?If I create a vlan interface and set the IP of it to 10.50.x.x then the vpn clients are suddenly unable to connect to any network resources...
View 1 Replies
View Related
Jun 24, 2012
I have a Cisco ASA 5505, with basic 50 license, that is connected directly to the Cable Modem with a public IP. I have VPN configured and active on the Outside interface. When we connect, we connect just fine with no errors, but we are not able to access any resources on the remote network.
ASA IOS version 8.2(5)
Remote Network IP: 10.0.0.0/24
VPN IP Pool: 192.168.102.10 - 25
View 4 Replies
View Related
Dec 9, 2010
I was unable to access my ASA 5520 using HTTP/HTTPS even on the management interface. I had upgrade the ASA IOS to asa832-k8.bin and ASDM to asdm-634-53.bin. But, the issue still the same.
My browser show the error message as attach image.
PGA-Firewall-02# sh run: Saved:ASA Version 8.3(2)!hostname PGA-Firewall-02enable password 8Ry2YjIyt7RRXU24 encryptedpasswd 2KFQnbNIdI.2KYOU encryptednames!interface GigabitEthernet0/0 nameif public security-level 0 ip
[Code]....
View 7 Replies
View Related
Jan 30, 2013
I am having issue with network connectivity between remote access (RA) VPN users and remote site VPN hosts.
Topology is:
RA VPN laptop (192.168.200.3 /24) ---- internet ---- Head Office (ASA5505) -- LAN subnet 10.0.0.0 /24
SiteB (10.0.10.0 /24) ---- internet ----- Head Office (ASA5505) ---- LAN subnet 10.0.0.0 /24
From head office there is no issue communicating with RA VPN and siteB hosts but Site B hosts and RA VPN users can not communicate each other totally (ping failed too).
Site B is using Cisco 867 router with IPSEC VPN to the ASA5505 at head office. I have added the ACL on this router to access 192.168.200.x /24 for VPN traffic and exempt from NATing. When I enabled ' drop log' in the class-map in the Zone based firewall config, I could not see any ping packt comes in so I believe the issue is at ASA5505 config.
At ASA5505 I use split VPN tunnel ACL and have included the subnet for 10.0.10.0/24 as well as 192.168.200.0 /24. This split tunnel ACL are applied to both the IPSec VPN tunnel and also the RA VPN group policy. The ASA is using sw version 151-4.M5.
View 6 Replies
View Related
Feb 27, 2012
I have installed and setup cisco anyconnect on a win2008 server. It is able to authenticate successfully but upon trying to establish the vpn connection to the asa5520, it shows "unable to establish vpn". Other servers and pc from the same remote site is able to establish the vpn.
View 1 Replies
View Related
Jun 9, 2013
I have a weird problem which I have already submitted a TAC ticket about. When users authenticate through AnyConnect into our HQ ASA 5510 they grab an address from 172.16.254.x. What we have been noticing intermittently is that when logged into our network through the client they are unable to access their resources at one of our remote offices which is connected over l2l to the HQ ASA. This problem just started randomly a week ago and we have been working with Cisco trying to create a solution.
My quick fix is logging into a device at the remote office which is trying to be accessed and pinging the gateway of the virtual subnet for AnyConnect users. When I ping 172.16.254.1 it goes through after a few dropped icmp packets and then the issue is resolved for about 8 hours or so.
View 1 Replies
View Related
