up vote 1 down vote favorite
1
share [g+] share [fb]

I've got the following set up:

LAN ->  DHCP / DNS / VPN server (OSX 10.6) -> Cisco ASA 5505 -> WAN

Connecting to the LAN via VPN works fine. I get all the details properly and I can ping any host on the internal network using their IP. However, I can't do any host lookups whatsoever. I've looked through the logs on and found this nugget in the firewall log:

3 Sep 08 2010 10:46:40 305006 10.0.0.197 65371 portmap translation creation failed for udp src inside:myhostname.local/53 dst inside:10.0.0.197/65371

Port 53 is dns services, no? Because of that log entry, I'm thinking that the issue is with the firewall, not the server. Any ideas? Please keep in mind that I have very little knowledge and experience with this kind of firewall and the little experience I do have is with the ASDM GUI console, not the CLI console.

link|improve this question
67% accept rate
As a first step, verify that the VPN client is set to use your internal DNS servers for name resolution. On a Windows client you can check this by running ipconfig/all from a command line. – joeqwerty Sep 8 '10 at 12:15
I've verified that all the settings are ok. Additionally, I've tried nslookup and specifying the server to be the internal DNS. Pinging any client on the internal network works, including the DNS server so it is indeed reachable. However, all attempts att name resolution ends with a time out. However, trying name resolution with an external server, such as googles, works just fine. – macke Sep 8 '10 at 14:38
portmap translation errors indicate a problem with ip address translations. if you are using nat make sure you have an entry for both src/dst ip addresses; if you are using 'nat 0'the same is true. – BCV Jul 31 '11 at 0:29
feedback

2 Answers

up vote 0 down vote

1) Are your clients establishing the tunnel directly with the ASA or with the "VPN server" in your diagram? 2) Are your VPN clients being given the same IP range as your internal network or a separate range?

Based on the log entry, it sounds like your clients are establishing the tunnel to the ASA and given a different subnet than the internal network. If this is the case, I think you need a NAT exemption rule on your ASA to tell it not to try and NAT traffic between your internal IP range and your VPN IP range. This preserves your source (VPN subnet) and destination networks (internal subnet) so the ASA doesn't think it needs a public/private NAT rule for access to the internal network based on the 2 interfaces it is seeing the traffic come through on. In the GUI this is under: Configuration tab>>Firewall>>NAT Rules although I've had mixed experiences making rules like this in the GUI - might have to go to the CLI.

link|improve this answer
1) Not with the ASA. 2) Same IP range. I think you may very well be right. However, I can't really make sense of the GUI either. – macke Sep 8 '10 at 18:33
I'm not sure I'm getting this correctly, should I make an exempt rule going from inside-network/24 to inside-network/24? I tried, but it didn't work. Log still shows the same errors. – macke Sep 8 '10 at 19:56
feedback
up vote 0 down vote

In my experience this should work with the out of the box config of the ASA. Check for any DHCP settings on the ASA that might be overriding your settings from your LAN DHCP server.

Lines to look for are dhcpd domain, dhcpd dns and dhcpd auto_config.

The setup I use is pretty robust, but has the ASA doing DHCP for the local clients - this means that if the VPN goes down, users still have access to local systems.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.