0

I wonder what is wrong with a asa5510-setup I got delivered from some guys. The address pool set up on the asa-box is 192.168.3.0 for anyconnect.

When I log in trough anyconnect, I can reach all ip addresses on my subnet, wich is 192.168.2.0, but when I try to reach the subnet on another location 10.0.1.0, wich is set up with vpn-site-to-site, nothing is reachable.

I can of course reach (ping recources) the 10.0.1.0- subnet when logged in on my windows domain, locally.

What am I missing? Btw, can I set anyconnect to use dhcp-server in my domain (windows 2008 server dhcp).

Improve this question

2 Answers 2

Reset to default
1

I recently deployed a very similar setup with a pair of ASA 5510's and we had the same problem trying to get VPN clients on one ASA to speak to a subnet reachable only across an IPsec tunnel between the two ASA's. By default there is no rule to allow traffic between those subnets between the outside interface and inside interface and since the default behavior is to drop traffic from outside to inside the traffic was getting dropped. It's a little odd to think about at first but keep in mind that even though your VPN clients are on a private address space the traffic is still coming in through the outside interface and rules need to be setup accordingly. For us the solution was simple, allow IPsec traffic from the VPN client network to the foreign network from outside to inside and vise versa. Everything immediately started working.

Improve this answer
1

My first guess is that you need to set up the ASA to not NAT traffic going to the other subnet

access-list NONAT extended permit ip 10.0.0.0 255.255.255.0 10.0.1.0 255.255.255.0
nat (inside) 0 access-list NONAT

You will need to edit the ACL to fit your needs.

Again, just a guess.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .