0

I have an ASA with a working Cisco VPN Client configuration set up. I am trying to phase out the Cisco VPN Client, initially in favour of L2TP.

The Cisco Client policy has end-users fetch their address from a DHCP server which doles out a specific subnet. Wanting to stick to that subnet, because there are nat-exempt and hairpin-nat rules already in place for it, that forward the clients on to other sites.

I have also got a split-tunnel-network-list applied.

I can get the end-user L2TP client to connect, no problem at all. I can get the L2TP client to fetch its addresses from the DHCP server (confirmed via server lease info and via show vpn-sessiondb). However, no traffic passes because the client either never receives or discards the static routes normally applied by the split-tunnel-network-list, in favour of an incorrect route.

If I take the dhcp-server out of the tunnel-group and use an arbitrary ip local pool instead, the L2TP client adds the routes as per the split-tunnel-network-list ACL, but then won't pass the traffic because the nat-exempt and hairpin-nat does not match the ip local pool range.

If take the dhcp-server out of the tunnel-group and use the same subnet as the DHCP server in the ip local pool (i.e. to match the nat rules), the L2TP client goes back to not adding the routes.

I know I can double-up all the nat-exempt and hairpin-nat rules so there are rules for both the dhcp-server subnet and the ip local pool, but I don't see why I should have to.

What is stopping the routes being supplied/received/applied properly between the ASA and the L2TP clients?

(sanitised, hopefully-pertinent config below — there are far more VPNs and sites in the actual config, hence the desire not to change the subnet)

interface Redundant1
 nameif OUTSIDE
 security-level 0
 ip address p.e.e.r 255.255.255.0
!
interface Redundant2.1
 vlan 1
 nameif INSIDE
 security-level 100
 ip address 172.21.0.10 255.255.240.0
!

object network VPN_CLIENT_LAN
 subnet 172.21.255.0 255.255.255.0
object network HAIRPIN_NAT_IP
 host 172.21.0.1
object network IDONTWANTTHIS_POOL_LAN
 subnet 192.168.254.0 255.255.255.0

object-group network HEADOFFICE_LAN
 network-object 172.21.0.0 255.255.240.0
object-group network BRANCHOFFICE_LAN
 network-object 172.21.16.0 255.255.240.0
object-group network DATACENTRE1_LAN
 network-object 172.27.0.0 255.255.0.0
object-group network DATACENTRE2_LAN
 network-object 172.28.0.0 255.255.0.0
object-group network SITE_LANS
 group-object HEADOFFICE_LAN
 group-object BRANCHOFFICE_LAN
 group-object DATACENTRE1_LAN
 group-object DATACENTRE2_LAN
object-group network CLIENT_VPN_ACCESSIBLE_NETWORKS
 group-object SITE_LANS

access-list CRY_RA_OUTSIDE extended permit ip any object VPN_CLIENT_LAN

access-list ACL_CLIENT_VPN_SPLIT_TUNNEL extended permit ip object-group CLIENT_VPN_ACCESSIBLE_NETWORKS object VPN_CLIENT_LAN 

ip local pool IDONTWANTTHIS_POOL 192.168.254.1-192.168.254.254 mask 255.255.255.255

nat (OUTSIDE,OUTSIDE) source dynamic VPN_CLIENT_LAN HAIRPIN_NAT_IP destination static CLIENT_VPN_ACCESSIBLE_NETWORKS CLIENT_VPN_ACCESSIBLE_NETWORKS
nat (INSIDE,INSIDE) source static HEADOFFICE_LAN HEADOFFICE_LAN destination static VPN_CLIENT_LAN VPN_CLIENT_LAN no-proxy-arp route-lookup
nat (INSIDE,INSIDE) source static HEADOFFICE_LAN HEADOFFICE_LAN destination static SITE_LANS SITE_LANS no-proxy-arp route-lookup
nat (INSIDE,OUTSIDE) source static HEADOFFICE_LAN HEADOFFICE_LAN destination static IDONTWANTTHIS_POOL_LAN IDONTWANTTHIS_POOL_LAN no-proxy-arp route-lookup
nat (INSIDE,OUTSIDE) source static HEADOFFICE_LAN HEADOFFICE_LAN destination static VPN_CLIENT_LAN VPN_CLIENT_LAN no-proxy-arp route-lookup
nat (INSIDE,OUTSIDE) source static HEADOFFICE_LAN HEADOFFICE_LAN destination static SITE_LANS SITE_LANS no-proxy-arp route-lookup
!
nat (INSIDE,OUTSIDE) after-auto source dynamic HEADOFFICE_LAN interface destination static ANY_IPV4 ANY_IPV4

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES128-SHA1-TRANSPORT esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES128-SHA1-TRANSPORT mode transport    

crypto dynamic-map CRY_RA_OUTSIDE 10 match address CRY_RA_OUTSIDE
crypto dynamic-map CRY_RA_OUTSIDE 10 set ikev1 transform-set ESP-3DES-MD5
crypto dynamic-map CRY_RA_OUTSIDE 10 set security-association lifetime seconds 28800
crypto dynamic-map CRY_RA_OUTSIDE 10 set reverse-route
crypto dynamic-map CRY_RA_OUTSIDE 20 set ikev1 transform-set ESP-AES128-SHA1-TRANSPORT
crypto dynamic-map CRY_RA_OUTSIDE 20 set security-association lifetime seconds 3600
crypto dynamic-map CRY_RA_OUTSIDE 20 set reverse-route
crypto map CRY_L2L_OUTSIDE 65535 ipsec-isakmp dynamic CRY_RA_OUTSIDE
crypto map CRY_L2L_OUTSIDE interface OUTSIDE
crypto isakmp identity address

group-policy GPO_CISCO_CLIENT_VPN internal
group-policy GPO_CISCO_CLIENT_VPN attributes
 dns-server value 172.21.1.1 172.21.1.2
 dhcp-network-scope 172.21.255.0
 vpn-idle-timeout 1800
 vpn-tunnel-protocol ikev1
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value ACL_CLIENT_VPN_SPLIT_TUNNEL
 default-domain value foo.local

group-policy GPO_L2TP_CLIENT_VPN internal
group-policy GPO_L2TP_CLIENT_VPN attributes
 dhcp-network-scope 172.21.255.0
 vpn-tunnel-protocol l2tp-ipsec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value ACL_CLIENT_VPN_SPLIT_TUNNEL
 default-domain value foo.local
 intercept-dhcp enable
 nac-settings none

tunnel-group DefaultRAGroup general-attributes
 authentication-server-group (OUTSIDE) AAA_WORKING_RADIUS_SETUP
 default-group-policy GPO_L2TP_CLIENT_VPN
 dhcp-server 172.21.1.1
 dhcp-server 172.21.1.2    
tunnel-group DefaultRAGroup ipsec-attributes
 ikev1 pre-shared-key *****
 isakmp keepalive threshold 120 retry 2
tunnel-group DefaultRAGroup ppp-attributes
 no authentication chap
 authentication ms-chap-v2

tunnel-group GPO_CISCO_CLIENT_VPN type remote-access
tunnel-group GPO_CISCO_CLIENT_VPN general-attributes
 authentication-server-group (OUTSIDE) AAA_WORKING_RADIUS_SETUP
 default-group-policy GPO_CISCO_CLIENT_VPN 
 dhcp-server 172.21.1.2
 dhcp-server 172.21.1.1
tunnel-group GPO_CISCO_CLIENT_VPN ipsec-attributes
 ikev1 pre-shared-key *****

(The route that is added when using the dhcp-server config, where p.e.e.r is the outside IP of the ASA):

172.21.0.0     mask 255.255.0.0    gw p.e.e.r  if 172.21.255.1

(The routes that are added when using the arbitrary address-pool IDONTWANTTHIS_POOL config):

172.21.0.0     mask 255.255.240.0  gw on-link  if 192.168.254.1
172.21.16.0    mask 255.255.240.0  gw on-link  if 192.168.254.1
172.27.0.0     mask 255.255.0.0    gw on-link  if 192.168.254.1
172.28.0.0     mask 255.255.0.0    gw on-link  if 192.168.254.1
192.168.254.0  mask 255.255.255.0  gw p.e.e.r  if 192.168.254.1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.