Unable to connect via VPN to remote network

Question

PROBLEM: I'm unable to connect via VPN to our production network while connected to my home wireless network.

SETUP:

Internet
|
ISP router at home
|
Cisco ASA 5505 firewall
|
Buffalo wireless router/firewall
|
Wirelessly connected devices (iPhone and laptop)

• Guest wireless on ASA 5505.
• Guest wireless network on ASA 5505 is 172.16.1.0/24.
• LAN network on ASA 5505 is 172.16.2.0/24.
• Home wireless on Buffalo router.
• Home wireless network on Buffalo is 172.16.3.0/24.

SYMPTOMS:

• My PC connected to a switch port on the ASA 5505 can connect via VPN to our production network.
• Devices connecting to the guest wireless on the ASA 5505 can connect via VPN.
• Devices connecting to the home wireless on the Buffalo router can't connect via VPN.
• All devices can connect to various Internet sites, i.e. Yahoo, Google, etc.

THOUGHTS?

• Can you connect to a remote VPN endpoint with several NATs in between?
• Is this a NAT issue of some kind? How would I validate that?
• Am I violating a design best practice?
• What should be my next steps to troubleshoot/resolve this?

CLARIFICATION:
- IPSec connectivity works throughout the network.
- PPTP connectivity works through all but the Buffalo wireless.

Answer 1

If both the Buffalo and the 5505 are doing NAT then yes you are bypassing best practices.

Unless you need the further level of security I would look to disable the routing abilities of the Buffalo and use it just as a wireless AP (as that is why I'm guessing you have it).

This may be as simple as turning off the DHCP server on the Buffalo and plugging the ASA into a LAN port on the Buffalo rather than the WAN port.

In terms of why your VPN doesn't work behind the Buffalo I am guessing it is blocking the VPN traffic, make sure that the Buffalo has something like 'VPN passthrough' enabled.

Answer 2

This isn't really the answer to your question directly, but may point you in the right direction;

• Do you have any PMTUD issues when connected to the Buffalo device, between a Buffalo wireless client and the VPN end point at your production network?

• Can you verify the end to end MTU and ensure that isn't impacting the tunnel coming up?

• Do you have VPN pass-through configured (or a similar technology) on your Buffalo AP?

• Do you have any detailed logs to go on from your VPN client to tell you what is exactly wrong?

• Can you perform a packet capture on the client when attached to the Buffalo whilst trying to establish the VPN, and then again when it is attached to the ASA wireless to compare the difference?

• Can you also perform a packet capture on the ASA it's self, when the client is attached wirelessly to the ASA and wirelessly to the Buffalo making VPN connections to again, see the difference?

As already mentioned, double NAT is a bad idea. Turning you Buffalo wireless device in a AP only (bride mode or similar) may or may not be an option for you, but that is what I would recommend, rather than a routed mode.

Answer 3

I did two things to make the PPTP wireless client work:
1. Added a static NAT on the Buffalo for a wireless device.
2. Added the following to the ASA:

policy-map global_policy
class inspection_default
inspect pptp

After adding the static NAT but before modifying the ASA I saw the following error in the ASA log:

May 20 2013 06:42:05: %ASA-3-305006: regular translation creation failed for protocol 47 src inside:192.168.1.50 dst outside:(vpn-at-work-IP-address)<br>

I had to allow PPTP inspection.

So I am able to connect via IPSec and PPTP through 2 NATs, although evidently that's not a best practice, so I'll be reading up more on that.