2

First of all, I have fairly basic knowledge of Cisco ASAs, but I'm attempting to look into something that is bugging me.

I am working through the ASDM as opposed to the CLI.

We have a Cisco ASA5505 router that has 192.168.1.x network on linking on Ethernet Port 0. We also have a set of switches which are linked to the ASA through Ethernet Port 3 on 192.168.71.x.

The connectivity between the 2 is functioning without a hitch. My issue is currently with users that VPN in. When users VPN in they obtain a 192.168.73.x address given by the ASA. They are able to access anything on the 192.168.1.x through Ethernet 0 but unable to access anything on the 192.168.71.x network through Ethernet 3.

So, in a brief summary, no issues talking to either network when inside of the ASA but when connecting to the ASA through VPN only access to 192.168.1.x network on Ethernet 0.

Any pointers or information on where I should be looking for answers would be much appreciated, and if you need any more information to help, then by all means I can try and explain as best I can!

UPDATE:

Visit www.fresh.co.uk/CiscoConfiguration/Cisco.txt for Configuration of Cisco ASA.

Also, have an issue on here which could well be part of the issue. Under VPN > Connection Gateway, there is an Entry in there for the 71.x network (the network needed access) which is pointing to the incorrect gateway. I attempted to change this to the correct gateway (71.253), but an error for Cannot Remove Connected route and Cannot add route, Connected route exists.

  • Have you looked in the log for debug information? Also, if you can post your ASA config, then we don't have to guess. – Ron Trunk Jun 27 '15 at 11:44
  • Have added a link to configuration file: www.fresh.co.uk/CiscoConfiguration/Cisco.txt - hope this helps. – BennyP Jun 29 '15 at 11:22
  • Ahh, I had typed out a long answer, but then realized half way through that your networks aren't all /24's, and what I thought was missing from your encryption domain is not actually missing. I'll need a bit more information to help out. Could you post the output of show vpn-sessiondb detail remote (it might be ra instead of remote in some code versions) and show ipsec sa when you have a VPN user connected and trying to ping something on the other side of the Site-Site VPN? – Eddie Jun 29 '15 at 13:38
  • I can't access the file. It's most likely a NAT or ACL issue. Update your post with a filtered configuration and it will be much easier for us to help you. If you want to fix your route issue log in to the console and do the following in config mode: route "interface name" network mask destination – Daniel Sep 28 '15 at 1:29
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 18:31
2

I had to make a similar change recently. I needed to add two additional subnets. Though I used CLI rather than ASDM. With version 9.1, I created some new objects for the subnets and then it was just a matter of adding the additional subnets to the split-tunnel ACL (if used) as well as adding additional NAT rules.

For example:

object network {REMOTE_VPN_USER_SUBNET}
 subnet 10.0.1.0 255.255.255.0
object network {EXISTING_VPN_ACCESSIBLE_SUBNET_1}
 subnet 10.0.2.0 255.255.255.0
object network {NEW_VPN_ACCESSIBLE_SUBNET_2}
 subnet 10.0.3.0 255.255.254.0
object network {NEW_VPN_ACCESSIBLE_SUBNET_3}
 subnet 10.0.4.0 255.255.255.0

split-tunnel-network-list value {YOUR_SPLIT-TUNNEL_LIST}
access-list {YOUR_SPLIT-TUNNEL_LIST} standard permit 10.0.1.0 255.255.255.0 
access-list {YOUR_SPLIT-TUNNEL_LIST} standard permit 10.0.2.0 255.255.255.0 
access-list {YOUR_SPLIT-TUNNEL_LIST} standard permit 10.0.3.0 255.255.255.0 

nat (RELEVANT_INTERFACE_OR_VLAN_NAME,outside) source static {EXISTING_VPN_ACCESSIBLE_SUBNET_1} {EXISTING_VPN_ACCESSIBLE_SUBNET_1} destination static {REMOTE_VPN_USER_SUBNET} {REMOTE_VPN_USER_SUBNET} no-proxy-arp route-lookup
nat (RELEVANT_INTERFACE_OR_VLAN_NAME,outside) source static {NEW_VPN_ACCESSIBLE_SUBNET_2} {NEW_VPN_ACCESSIBLE_SUBNET_2} destination static {REMOTE_VPN_USER_SUBNET} {REMOTE_VPN_USER_SUBNET} no-proxy-arp route-lookup
nat (RELEVANT_INTERFACE_OR_VLAN_NAME,outside) source static {NEW_VPN_ACCESSIBLE_SUBNET_3} {NEW_VPN_ACCESSIBLE_SUBNET_3} destination static {REMOTE_VPN_USER_SUBNET} {REMOTE_VPN_USER_SUBNET} no-proxy-arp route-lookup
0

Have a look at your IPSec settings (optional). You probably need to tweak the 'interface' and/or 'exempt networks' - which network(s) are subject to NAT and which are not.

  • Under the IPSec Settings the "Enable Inbound VPN Sessions to bypass interface access lists. Group Policy and per-user authorization access lists still apply to the traffic" option is currently ticked. Have included the interface in the "Allow access" option but still no luck on this. The config is at www.fresh.co.uk/CiscoConfiguration/Cisco.txt Thanks – BennyP Jun 29 '15 at 11:24
0

Check the group policy associated with your AnyConnect profile, and make sure that the ACL used for it allows traffic to pass to the needed subnet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.