Timeline for ASA 5505 remote access VPN - Connection established, but no internet/access to internal subnet
Current License: CC BY-SA 3.0
40 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 10, 2017 at 11:52 | vote | accept | mikeazo | ||
| Aug 10, 2017 at 11:52 | answer | added | mikeazo | timeline score: 1 | |
| Jul 8, 2015 at 5:13 | answer | added | Joseph Drane | timeline score: 0 | |
| Feb 19, 2015 at 13:21 | answer | added | user3347934 | timeline score: 0 | |
| Jan 21, 2015 at 19:26 | answer | added | Citizen | timeline score: 1 | |
| Mar 21, 2014 at 21:28 | comment | added | James.Birmingham | I am not, however, able to access the internet through the VPN. Looks like you're configured for a split tunnel so you won't be using the tunnel for internet traffic. If you tunnel all traffic you should be able to access the internet through the VPN. | |
| Mar 21, 2014 at 19:29 | comment | added | Ron Trunk | Have you tried "same-security-traffic permit intra-interface"? | |
| Mar 21, 2014 at 18:37 | history | edited | mikeazo | CC BY-SA 3.0 |
deleted 18 characters in body
|
| Mar 21, 2014 at 17:42 | history | edited | mikeazo | CC BY-SA 3.0 |
added 6508 characters in body
|
| Feb 21, 2014 at 13:34 | history | edited | Ryan Foley | CC BY-SA 3.0 |
Improved code readability, added update breaks.
|
| S Feb 18, 2014 at 17:44 | history | bounty ended | CommunityBot | ||
| S Feb 18, 2014 at 17:44 | history | notice removed | CommunityBot | ||
| Feb 17, 2014 at 10:23 | comment | added | mihai | remove this line :access-list DefaultRAGroup_splitTunnelAcl standard permit 192.168.3.96 255.255.255.224 And then try to see if you can hit 10.3.3.0 network using the VPN. | |
| Feb 14, 2014 at 16:52 | comment | added | mikeazo | @mihai, just double checked with a trace route. No 192.168.3.x along the path. good suggestion though. | |
| Feb 14, 2014 at 8:41 | comment | added | mihai | Are you sure that from where you are trying to use the vpn , the ip does not conflict with the one you get when you connect to the vpn ? I mean you don't already have 192.168.3.x IP on your device before you connect. | |
| Feb 12, 2014 at 16:51 | comment | added | root | @mikeazo This question has me interested, update us with any updates/changes | |
| Feb 12, 2014 at 14:01 | comment | added | mikeazo | @root. I tried that and it didn't make a difference. We are working on purchasing a support contract so we can update to 9.x. Based on some info I found on the Cisco forums posted by a Cisco employee, I think that is the best path forward. | |
| Feb 11, 2014 at 20:20 | comment | added | root |
@mikeazo Then you should be ok on the ICMP front. Deny inbound UDP... due to DNS Query, could this link be related? To permit communication between interfaces with equal security levels, or to allow traffic to enter and exit the same interface, use the same-security-traffic intra-interface command in global configuration mode.
|
|
| Feb 11, 2014 at 19:01 | comment | added | mikeazo | @root, enabled where? Internal clients can ping the internal and external interface IPs and other public IPs, just not VPN clients. VPN clients can ping the ASA's external IP, but nothing else. | |
| Feb 11, 2014 at 18:55 | comment | added | root | Just to make sure, is ICMP enabled? | |
| Feb 11, 2014 at 14:35 | history | edited | mikeazo | CC BY-SA 3.0 |
added 1002 characters in body
|
| Feb 10, 2014 at 21:53 | history | edited | mikeazo | CC BY-SA 3.0 |
added 8 characters in body
|
| Feb 10, 2014 at 20:21 | history | edited | mikeazo | CC BY-SA 3.0 |
added 517 characters in body
|
| Feb 10, 2014 at 19:55 | history | edited | mikeazo | CC BY-SA 3.0 |
deleted 3 characters in body
|
| Feb 10, 2014 at 18:28 | comment | added | Ron Trunk | let us continue this discussion in chat | |
| Feb 10, 2014 at 18:25 | comment | added | mikeazo | @ron updated with the crypto map. | |
| Feb 10, 2014 at 18:24 | history | edited | mikeazo | CC BY-SA 3.0 |
added 1413 characters in body
|
| Feb 10, 2014 at 18:19 | comment | added | Ron Trunk | In that case, your nat0 statement doesn't seem to be matching your traffic. Can you also include the crypto map portion of your config? | |
| Feb 10, 2014 at 17:50 | comment | added | mikeazo | @Ron, I removed nat (inside) 1 and did clear xlate. Then my internal machine was unable to access the internet and I still couldn't ping from internal to vpn. | |
| Feb 10, 2014 at 17:44 | comment | added | Ron Trunk | Don't forget to clear xlate | |
| Feb 10, 2014 at 17:22 | comment | added | Ron Trunk | As an experiment, remove the nat(1) statement and see if it works. | |
| S Feb 10, 2014 at 16:27 | history | bounty started | mikeazo | ||
| S Feb 10, 2014 at 16:27 | history | notice added | mikeazo | Draw attention | |
| Feb 10, 2014 at 15:10 | history | edited | mikeazo | CC BY-SA 3.0 |
deleted 1 characters in body
|
| Feb 10, 2014 at 14:58 | history | edited | mikeazo | CC BY-SA 3.0 |
added 4104 characters in body
|
| Feb 10, 2014 at 13:13 | comment | added | mikeazo | @Ron to simulate an http packet from the VPN would I use this packet-tracer input outside 192.168.3.100 50612 8.8.8.8 80? I'm confused as to whether I should use outside or inside for VPN traffic. | |
| Feb 9, 2014 at 16:25 | comment | added | Ron Trunk | Have you tried using the packet tracer feature of the ASA to see where things might be going awry? | |
| Feb 9, 2014 at 4:35 | history | tweeted | twitter.com/#!/StackNetworkEng/status/432372230396583936 | ||
| Feb 8, 2014 at 15:13 | review | First posts | |||
| Feb 8, 2014 at 15:48 | |||||
| Feb 8, 2014 at 14:55 | history | asked | mikeazo | CC BY-SA 3.0 |