I’ve setup VPN on our ASA5510 (8.0.(3)), everything seems to work fine except I can’t remotely get to our satellite offices or any routers/switches on the 10.76.x.x network…seems like it would be a routing issue or an ACL not configured to allow the VPN DHCP group to talk to the 10.76 network, but I’m not seeing it so far.
VPN DHCP scope is 10.74.10.0/24 – when on VPN I can successfully ping our internal network (10.74.4.0/23) and access everything on the network needed, but if I try to ping 10.76.x.x (10.76.0.x or our switches/routers/etc, 10.76.1.0/26 for our satellite offices) or remote to them, I can’t get through. It simply can’t seem to see the 10.76.x.x networks….
I have an exempt statement on the ASA on the outside, 10.74.10.0/24 to 10.74.0.0/16 inbound, and one just like it for 10.76.0.0/16. I also have an inside exempt statement in reverse, inside, 10.74.0.0/16 to 10.74.10.0/24, and one just like it for 10.76.0.0/16.
On the firewall I have an ACL on the inside from 10.74.0.0/16 to 10.74.10.0/24 permit IP, seems to be working and I see the hit count going up. I have a statement just like it for 10.76.0.0/16 but I never it see it being referenced, sitting at 0 hits.
On the firewall I have an ACL on the outside from outside saying 10.74.10.0/24 to 10.74.0.0/16 permit IP, works and I see the hit count going up, but have a similar statement for 10.76.0.0/16 and same as above, no hits.
I have the default tunneled route set to our inside interface.
I probably have too much allowed currently, or at least a line or two that is unnecessary but if I could get it work then I could step it back down to tighten it up… I’ve tried looking at the logs as well. I’ve logged onto kiwi syslog, monitored it while I attempt to ping 10.76.x.x from a laptop connected to VPN. I never see a deny for it, nor do I even see the 10.76 address anywhere in the log when I do a search. I see the IP of the laptop from where it is talking with our domain controller, where it does it’s initializations and such, but nothing referencing the 10.76 network. I would expect to see an entry somewhere as to where it’s being stopped…but that makes me think it’s not even making it to that point.
I’m sure like usual it’s something small I’m overlooking, but having a fresh set of eyes (or many fresh sets of eyes!) on it might be what it needs. I appreciate the help, thanks!