Networking :: Multi Tenant VPN Remote Access ASA 5510

Apr 4, 2011

I have a situation here where the company is rapidly expanding through acquisition. They are essentially a holding company and own several smaller entities. However most IT is consolidated as new entities are brought in and run out of Headquarters because the Board of Directors/Executive Mgt do not see IT as important and so the budget is extremely limited.

They have approximately 200 remote users at any given time, but they all work for these smaller entities. Currently each location has its own Dedicated Internet Access and VPN appliance (Netgear ProSafe, Cisco ASA 5510, I know of one entity that is just port forwarding to each workstation for RDP ).

They would like to route all traffic back through Corporate so they can consolidate this VPN mess and quit paying for all different kinds of licensing, and also stop paying for dedicated internet access for each location and just use the MPLS and have all traffic inbound/outbound run out of the corporate office.

The only issue is they dont want users to be able to access network resources at other organizations.

Like I said earlier the Board of Directors/Executive Mgt do not see IT as important and so the budget is extremely limited; so if there is an OpenSource option available that would be best. Also the IT dept there is 3 people (IT Manager (IBM AS400 guy), two Helpdesk guys (no certs, HS GED)) So the knowledge resources are limited as well.

View 4 Replies


ADVERTISEMENT

Cisco Switching/Routing :: Multi Tenant Security On 3750

May 21, 2012

I have a 3750 switch with IP routing enabled and have lots of VLANs configured on this switch.What is the best way to prevent VLANs from talking to each other?At the same time, hosts inside their respective VLANs should not be blocked from reaching any private networks as they could be doing some L2L with another site.Blocking the VLANs from accessing/telnetting the switch was very simple as I was able to do this in the VTY line section. However blocking VLANs from accessing the other VLANs on the switch seem to be hard and I think there has to be a recommended way of doing this. For example, if hosts in one of my VLANs, in this case VLAN-204 (10.10.10.0/24) want to hack or scan hosts on one of my other VLANs, in this case VLAN-330 (10.20.20.0/24), how can I accomplish this without blocking VLAN-204 hosts from accessing another network they have a site to site tunnel with with the same destination address of 10.20.20.0????

View 2 Replies View Related

Cisco VPN :: ASA 5510 - Remote Access VPN And DNS?

May 25, 2011

I have a remove access vpn configured on my ASA 5510 which works fine, VPN pool easily allocates IP to all remote used , but they have few network drivers shared on their machines & most of them are linked using the computer name rather than the IP which normally doesnt work as VPN pool doesnt provides the DNS IP to the remote clients . Is it possible to allocate DNS IP with the VPN IP ?

View 1 Replies View Related

Cisco VPN :: Remote Access VPN ASA 5510

Mar 24, 2013

 I have a problem with a Remote Access VPN on a ASA 5510 8.6.2 .I have created a IPSEC Remote Access VPN through the wizard this is pretty much a base install on the ASA without much configuration.
 
I can connect to the ASA via the Remote Access client and get TX just no RX therefore i cannot access any of the LAN resources. [code]

View 13 Replies View Related

Cisco VPN :: Remote Access VPN For Android Using ASA 5510?

Feb 20, 2012

I want to setup remote access for my Android phones and tablets using Cisco ASA 5510 . Is there any particular Android client which perform the specified functionality.

View 1 Replies View Related

Cisco VPN :: Remote Access ASA 5505 To ASA 5510 VPN?

Mar 1, 2012

I have not really set up ASAs nor VPNs on Cisco devices before. I'm currently attempting to configure a remote access VPN between ASA devices, a 5505 and a 5510. The 5510 is meant to be the server and the 5505 is meant to be the easyvpn client. The reason I am opting for remote access as opposed to site to site is that I have many 5505s at remote sites that I will need to configure in the future, and they will be moving around a bit (I would prefer not to have to keep up with the site-to-site configs). The 5510 will not be moving. Both ASA devices are able to ping out to 8.8.8.8 as well as ping each other's public facing IP.
 
Neither ASA can ping the other ASA's private IP (this part makes sense), and I am unable to SSH from a client on the 5510 side to the 5505's internal (192) interface. I have pasted sterilized configs from both ASAs below. 
 
ASA 5510 (Server)
ASA Version 8.0(4)
!
hostname ASA5510
domain-name <domain>
enable password <password> encrypted
passwd <password> encrypted

[code].....

View 3 Replies View Related

Cisco VPN :: Remote Access VPN Latency With ASA 5510

Apr 21, 2013

I have an end user who uses the Anyconnect VPN client to connect to our network through an ASA5510. He has a satellite ISP provider and is experiencing latency issues. Since latency issues are inherent with satellite services and since he has no other ISP alternative, any tweaks that may boost performance/reduce latency with his connection. Typcally, he sees slow performance and also network drives being intermittently available on his Windows 7 computer. he also has an internal wireless router at his home when he connects remotely. Performance when connected through a standard cable broadband connection is fine.

View 2 Replies View Related

Cisco :: ASA 5510 - Configure Remote Access VPN To Network?

Sep 23, 2011

I am trying to configure remote access VPN to my network, i have a Cisco ASA 5510 IOS 7.0(7).

I configured the VPN using ASDM 5.0.9 and below is the configuration received:

access-list 90 extended permit ip 192.xxx.xxx.0 255.255.255.0 192.xxx.xxx.248 255.255.255.248
access-list ClientVPN_splitTunnelAcl standard permit 192.xxx.xxx.0 255.255.255.0
ip local pool VPNIpPool 192.xxx.xxx.250-192.xxx.xxx.252 mask 255.255.255.0[code].....

View 5 Replies View Related

Cisco VPN :: ASA 5510 Access All Branches Using Remote Client

Jun 18, 2011

I am having asa 5520 in my head office and in branches 2811 routers.i connected two branches with my HO through VPN.now i configured remote vpn client in HO asa . now i need to access all the branches using this remote client.how i create route in HO ASA.

View 7 Replies View Related

Cisco WAN :: 5510 - Remote Vpn Cannot Access Inside User

Oct 20, 2011

ip local pool VPNPOOL 192.168.200.1-192.168.200.100.
 
i can access servers with remote vpn which they located at dmz zone at asa(write nonat access-lsit) but i can not 192.168.193.0 subnet at asa.i configurated proxy server. my proxy server inside interface get ip address my dmz zone(172.16.10.254) and outside is ip adddress asa outside interface (10.0.0.254).the users (192.168.193.0/24) go internet from proxy server.
 
[code]....

View 4 Replies View Related

Cisco VPN :: Remote Access With ASA 5510 Using DHCP Server?

Nov 28, 2011

why I am not able to receive an IP address on remote access VPN connection while I can get an IP address on local DHCP pool?I am trying to setup remote access VPN with ASA 5510. It works with local dhcp pool but doesn't seem to work when I tried using an existing DHCP server. It is being tested in an internal network as follows:

!
ASA Version 8.2(5)
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 10.6.0.12 255.255.254.0

[code]....

View 3 Replies View Related

Cisco VPN :: 5510 Specify Remote Access Interesting Traffic?

Feb 9, 2013

I am having trouble making my remote access vpn decrypt traffic. I am using an ASA5510 and the cisco 5.0 vpn client. I have no problem getting the tunnel to come up. But the "decrypted traffic" stays zero and the "discarded traffic" increments continuously.Here is the ASA5510 crypto config:OK I guess this site doesn't allow pasting text so I attached the config.I am pretty sure that I can't pass traffic because I have not been able to figure out how to specify the interesting traffic for the vpn connection. What is the syntax for this? It looks like it should be some kind of tunnel- group commands.
 
Am I the only one who thinks that the Cisco documentation is worthless on this subject? The ASA config guide gives you everything you need to set up a tunnel, but has absolutely nothing on the config required to actually pass traffic.

View 3 Replies View Related

Cisco VPN :: ASA 5510 - Remote Access VPN Failed After WAN-IP Change

Jun 23, 2012

Router: ASA 5510
 
We have changed the ISP, so therefore new wan ip-addresses.
 
Internet works, and site-to-site vpn works, but I'm failing to localice why the remote access vpn won't work.

View 10 Replies View Related

Cisco VPN :: ASA 5510 - Remote Access Setup / Keep Getting Logs

Apr 17, 2011

I have a problem with ASA 5510 8.0(4) This is a remote-access VPN setup and it's functional, no problems here...

But I keep getting logs like this every few seconds:

Group = <censored>, Username = <censored>, IP = <censored>, Reaper overriding refCnt [0] and tunnelCnt [0] -- deleting SA!
Group = <censored>, Username = <censored>, IP = <censored>, SA lock refCnt = 0, bitmask = 00000080, p1_decrypt_cb = 0, qm_decrypt_cb = 0, qm_hash_cb = 0, qm_spi_ok_cb = 0, qm_dh_cb = 0, qm_secret_key_cb = 0, qm_encrypt_cb = 0

View 1 Replies View Related

Cisco Firewall :: ASA 5510 / ASDM Access With Remote VPN

Apr 18, 2012

I have a cisco ASA 5510 that I have set up currently to access via ASDM through the Inside interface. When I VPN in using our older VPN server I can connect to it fine.  I recently set up the ASA to also be a VPN server which will eventually replace the older server for our HQ.  I noticed that when I'm VPN using the ASA as the VPN server, I can only ASDM to the public which I prefer not to allow.  Access to the inside doesn't seem to work this way. What configurations if any would be causing this.  I'm assuming it's some thing I need to adjust in the VPN configuration.

View 3 Replies View Related

Cisco VPN :: ASA 5510 / VPN Remote Access Split Tunneling?

Sep 27, 2012

I have a ASA 5510 configured for IPSec remote access VPN.It works nicely and can see the private LAN behind the ASA.My problem is that I have other networks connected to this ASA via site-to-site tunnels that I would like to open up to remote access.

I have added these networks to the split-tunneling ACL's and added NAT exemptions for those networks.This doesn't seem to work.

View 21 Replies View Related

Cisco VPN :: 5510 Restrict Remote VPN Access For MAC OS X Users

Feb 12, 2013

I need a way to block MAC OS X users connecting remotely to our coporate users over VPN. I know there is an option to block connections based on VPN client Version, but cant find a way to block users based on operating system.
 
We use Cisco ASA 5510 firewals one with v8.2(1) and other with v7.2(3). I need to do on both firewalls. They are both at diffrent sites.

View 4 Replies View Related

Cisco VPN :: Remote Access With ASA 5510 Using DHCP Server

Jan 15, 2013

why I am not able to receive an IP address on remote access VPN connection while I can get an IP address on local DHCP pool?
 
I am trying to setup remote access VPN with ASA 5510. It works with local dhcp pool but doesn't seem to work when I tried using an existing DHCP server. It is being tested in an internal network as follows:

!
ASA Version 8.2(5)
!
interface Ethernet0/1

[Code]....

View 9 Replies View Related

Cisco VPN :: 5510 Remote Access VPN / Ping From Client

Jul 26, 2011

I'm configuring ASA 5510 Remote Access VPN, I can connect from Cisco VPN Client to the ASA VPN. I obtain from ASA some routes to inside networks, but I can't do any ping to those inside hosts. I have got those error in ASDM log file: [code]

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - PCI Scan For Remote Access VPN

Jul 2, 2012

We got the below alert when we ran the PCI scan on our VPN firewall (use it for remote access VPN).
 
OpenSSL SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG Ciphersuite Disabled Cipher Issue
 
Solution- Upgrade to OpenSSL 0.9.8j or later.
  
ASA 5510 running  8.2(2)

View 6 Replies View Related

Cisco VPN :: Remote Access Address Pool ASA 5510

Mar 17, 2013

Is the following sysntax correct in removing a remote access vpn address pool and inserting a new one on an ASA5510?
 
(config)# NO ip local pool BWCVPN 192.168.200.1-192.168.200.128
(config)# ip local pool BWCVPN 192.168.300.1-192.168.300.128
(confif)# tunnel-group BWCVPN ciscovpn general-attributes
(config-general)# address-pool BWCVPN

View 5 Replies View Related

Cisco VPN :: ASA 5510 / VPN Client Cannot Access Remote Servers

Mar 27, 2011

I have successfully installed and configured VPN Client - Version 5.0.07 to connect to ASA 5510 from a remote workstation. Here is the problem, I cannot ping any of the servers or workstations after I successfully connect. I can ping the ASA 5510 using its internal LAN IP, but no other nodes will respond on the remote LAN.

View 2 Replies View Related

Cisco VPN :: ASA 5510 - Clients Cannot Access Remote Site

Dec 12, 2011

I have 2 sites :

site A :
ASA 5510
VPN gateway for remote users
LAN 192.168.192.0/22
 site B :
ASA 5505
LAN 192.168.208.0/22
 
Both sites are connected through a site to site VPN.Remote clients (AnyConnect/VPN client) can connect to Site A LAN  and see machines on LAN A but cannot see Site B LAN.

Here is a part of my configuration :
 
On Site A (ASA 5510)
--------------------------------
name 192.168.192.0 SiteA_Internal_Network
name 192.168.208.0 SiteB_Internal_Network
name 192.168.133.0 VPNPool_AnyConnect
name 192.168.133.32 VPNPool_VpnClient

[code]....

View 9 Replies View Related

Cisco Security :: RDP Access For Remote VPN Client On ASA 5510?

Jan 17, 2011

We have configured site to site VPN tunnel from offshore to client location using ASA5510 and accessing RDP from client location. Also configured remote VPN access at offshore location. But using remote VPN client we are able to get RDP from officeshore location but not able to access RDP from client location. Is there any additional changes required ?

View 4 Replies View Related

Cisco VPN :: ASA 5510 / Create Different Group With VPN Remote Access

Apr 7, 2011

Last time, i´ve implemented a Remote Access VPN to my network with ASA 5510 I´ve allowed to my VPN an acces to all my Internal LAn But i want to configure a group of vpn  in the CLI for have different group of user which can access to different server or different network on my LAN.
 
Example : informatique group------access to 10.70.5.X   Network
                Consultor group -------- access to 10.70.10.X Network
 
I need to know how can i do that , and if you can give me some eg script for complete this Here is my configuration :
 
ASA Version 8.0(2)!hostname ASA-Vidruldomain-name vidrul-ao.comenable password 8Ry2YjIyt7RRXU24 encryptednamesdns-guard!interface Ethernet0/0 nameif outside security-level 0 ip address X.X.X.X 255.255.255.X!interface Ethernet0/1 nameif inside security-level 100 ip address  X.X.X.X 255.255.255.X!interface Ethernet0/2 shutdown no nameif no security-level no ip address!interface Ethernet0/3 shutdown no nameif no security-level no ip address!interface Management0/0 description Port_Device_Management nameif Management security-level 99 ip address  X.X.X.X 255.255.255.X management-only!passwd 2KFQnbNIdI.2KYOU encryptedftp mode passivedns server-group DefaultDNS domain-name vidrul-ao.comaccess-list 100 extended

[code]....

View 2 Replies View Related

Cisco VPN :: 5510 - Remote Access With / Without Split Tunneling Using External DNS

May 6, 2013

I've set up a remote access group for Anyconnect on a 5510 running 8.4.5.  Our company security policy prohibits split tunneling, but this particular location has no internal DNS (so I have to use a public DNS like google or something).   How do I get this to work, I'm assuming I need to do a NAT exemption but I'm not sure how this would look, especially under 8.4.5.

View 1 Replies View Related

Cisco Firewall :: 5510 Remote Access VPN / Change The Outside Interface IP

Dec 19, 2012

I have a Cisco 5510 which has remote access VPN configured.Now I have new block of IP address, is there a way I can just change the outside interface IP so that people can remote in without doing anythng else?Or if I coulds be taught to create a new one.Or best way to approcah this issue?For example: it was 67.64.x.x now I need to change to 64.44.x.x.

View 1 Replies View Related

Cisco Firewall :: 5510 Access List For Remote Vpn Users

Apr 5, 2011

How to designate access-list for the remote access vpn users in order to let them access specific subnet or host,asa 5510 and acs is in the picture

View 9 Replies View Related

Cisco VPN :: Configured Remote-access VPN On ASA 5510 - Cannot Reach Network

Mar 14, 2011

I configured a remote-access vpn on an ASA 5510 version 8.3. This is the configuration [code]The vpn goes up and I get an ip address, but it's impossible to reach the internal network. [code]

View 9 Replies View Related

Cisco AAA/Identity/Nac :: ASA 5510 - Remote Access To Network When Server Is Down

Jan 2, 2013

I have a Cisco ASA 5510. I have configured Cisco Anyconnect to authenticate via Windows IAS. We had an outage of that server recently and I tried to remote in via anyconnect and could not. Once the IAS server came up I could get back into the network.
 
Is there a command that I'm missing that will let me use Anyconnect to connect into the network even if my AAA server is down?

View 2 Replies View Related

Cisco VPN :: Configure ASA 5510 Remote Access For 2nd Public Interface?

Jun 4, 2013

  Our ASA 5510 was configured with a public interface, a DMZ interface, and a private interface.  I have a remote access VPN using AnyConnect client and LDAP authentication for Active Directory.  We are changing ISP (groan!), which means all new public IP addresses.  The new circuit is installed, so I have a second public interface (same security level as the first public interface, wholly different IP address range) enabled on the ASA.  I hope to transition whatever I can, which means get the VPN access through either public interface.  Can I just enable client access on the second public interface at the Anyconnect Connection Profiles tab in ASDM?  That seems too simple.  Can they share the one address pool? 

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - History Of Remote Access VPN For Last Week?

Apr 7, 2011

is there any method on the asa 5510 let u see the history of the remote access vpn connection for the last week

View 6 Replies View Related

Cisco VPN :: ASA 5510 - Configure Remote Access VPNs To Use Specific Interface

Aug 12, 2012

I am adding a second external connection to an existing system on an ASA 5510 with ASA V8.2 and ASDM 6.4. I added the new WAN using an other interface (newwan).
 
The intention is to route most internet traffic over the new route/interface (newwan) but keep our existing VPNs using the former interface (outside).

I used the ASDM GUI to make the changes and most of it works.ie. The default route goes via (newwan). Outgoing VPNs of a site to site nature use the previous route via (outside) as they now have static routes to achieve this.
 
The only problem is that incomming Remote Access Anyconnect VPNs are not working. I set the default static route to use the new interface (newwan) and the default tunneled route to be via (outside) but this is the point is goes wrong....
 
I can no longer ping the outside IP address from an external location. It seems the outside interface does not send traffic back to the - outside interface (or at least that's where I think the problem lies). How do I force replies to the incomming VPN remote traffic from unknown IPs to go back out on the outside interface?
 
The only change I need to make to get everything working on the outside interface again is to make the Default Static route use the outside interface. Which puts all the internet traffic back on the original (outside) connection.

View 6 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved