ASA 5505 VPN client communication through SitetoSite

[mennojd]

Hi,

We use a Cisco ASA 5505 as firewall for our branche office. On this ASA we have a Site-to-Site VPN tunnel running to our main office. Communication between all devices on both networks is allowed.
We are now trying to setup client vpn on the ASA to access the local network of the branch office and the local network of the main office.
I can connect and logon with the vpn client. I can also connect to devices on the local network of the branch office. However, I cannot connect to devices on the local network of the main office. Anyone any idea on how to do this? See our config below.


ASA Version 8.2(1)
!
hostname ciscoasa
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.254 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 200.200.200.200 255.255.255.248
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.252.0
access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.252.0 192.168.1.128 255.255.255.128
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.1.128 255.255.255.128
access-list outside_cryptomap_2 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list vpngroup_splitTunnelAcl_1 standard permit 192.168.2.0 255.255.252.0
access-list vpngroup_splitTunnelAcl_1 standard permit 192.168.1.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool vpngroupPool 192.168.1.180-192.168.1.199 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
no asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 200.200.200.201 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server NPS protocol radius
aaa-server NPS (inside) host 19.168.1.1
key **********
authentication-port 1812
accounting-port 1813
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 2 match address outside_cryptomap_2
crypto map outside_map 2 set peer 75.75.75.75
crypto map outside_map 2 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh 192.168.1.0 255.255.255.0 inside
ssh timeout 5
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy vpngroup internal
group-policy vpngroup attributes
wins-server value 192.168.1.1
dns-server value 192.168.1.1
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpngroup_splitTunnelAcl_1
default-domain value domain.local
tunnel-group 75.75.75.75 type ipsec-l2l
tunnel-group 75.75.75.75 ipsec-attributes
pre-shared-key *
tunnel-group vpngroup type remote-access
tunnel-group vpngroup general-attributes
address-pool vpngroupPool
authentication-server-group NPS
default-group-policy vpngroup
password-management password-expire-in-days 7
tunnel-group vpngroup ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:d3973d66b0ea31978ad07589fcc50a8c
: end

 

[hairlessupportmonkey]

whats the internal IP of the remote side? are the devices using the same gateway address as the remote asa?

ACSS - SME
General Geek

 

[mennojd]

The internal remote network is 192.168.2.0 255.255.252.0. I do not get your second question. What devices do you mean? VPN Clients?

 

[unclerico]

first thing i would do is get your vpn pool out of the ip range that the internal network of your main office is in. be sure to change your nonat and crypto ACLs to match. once that's done post back with results.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[mennojd]

Thanks for the tip. Will try that tomorrow and let you know.

 

[mennojd]

Sorry for the late reaction. Been busy with other stuff.
I did try your suggestion, but still not working. See the new config below.
Client vpn subnet is 192.168.100.0/24
Internal subnet of the asa is 192.168.1.1/24
Subnet of the remote site behind the Site-to-Site tunnel is 192.168.2.0/22
If I setup communication from the other site to the client vpn subnet I see traffic reaching my Asa 5505 so I can communicate over the Site-to-Site tunnel to the client vpn subnet. Just not getting any response, so it seems to be a problem on the Asa. Traffic just dies at the Asa.
If I check my log viewer and monitor traffic between the client vpn subnet and the remote site I see no traffic being blocked. I also see no messages for Built inbound or outbound connection. Only Teardown connection...

ASA Version 8.2(1)
!
hostname ciscoasa
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.254 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 200.200.200.200 255.255.255.248
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.252.0
access-list inside_nat0_outbound extended permit ip 192.168.100.0 255.255.255.0 192.168.2.0 255.255.252.0
access-list inside_nat0_outbound extended permit ip 192.168.2.0 255.255.252.0 192.168.100.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.100.0 255.255.255.0
access-list outside_cryptomap_2 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list outside_cryptomap_2 extended permit ip 192.168.100.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list vpngroup_splitTunnelAcl_1 standard permit 192.168.2.0 255.255.252.0
access-list vpngroup_splitTunnelAcl_1 standard permit 192.168.1.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool vpngroupPool 192.168.100.1-192.168.100.254 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
no asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 200.200.200.201 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server NPS protocol radius
aaa-server NPS (inside) host 19.168.1.1
key **********
authentication-port 1812
accounting-port 1813
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 2 match address outside_cryptomap_2
crypto map outside_map 2 set peer 75.75.75.75
crypto map outside_map 2 set transform-set ESP-3DES-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh 192.168.1.0 255.255.255.0 inside
ssh timeout 5
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy vpngroup internal
group-policy vpngroup attributes
wins-server value 192.168.1.1
dns-server value 192.168.1.1
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpngroup_splitTunnelAcl_1
default-domain value domain.local
tunnel-group 75.75.75.75 type ipsec-l2l
tunnel-group 75.75.75.75 ipsec-attributes
pre-shared-key *
tunnel-group vpngroup type remote-access
tunnel-group vpngroup general-attributes
address-pool vpngroupPool
authentication-server-group NPS
default-group-policy vpngroup
password-management password-expire-in-days 7
tunnel-group vpngroup ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:d3973d66b0ea31978ad07589fcc50a8c
: end

 

[mennojd]

Already got it working today thanks to this cisco document

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807f9a89.shtml

Just needed to add the following line to allow traffic between the different vpn tunnels

same-security-traffic permit intra-interface