Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I’ve setup VPN on our ASA5510 (8.0.(3)), everything seems to work fine except I can’t remotely get to our satellite offices or any routers/switches on the 10.76.x.x network…seems like it would be a routing issue or an ACL not configured to allow the VPN DHCP group to talk to the 10.76 network, but I’m not seeing it so far.

VPN DHCP scope is 10.74.10.0/24 – when on VPN I can successfully ping our internal network (10.74.4.0/23) and access everything on the network needed, but if I try to ping 10.76.x.x (10.76.0.x or our switches/routers/etc, 10.76.1.0/26 for our satellite offices) or remote to them, I can’t get through. It simply can’t seem to see the 10.76.x.x networks….

I have an exempt statement on the ASA on the outside, 10.74.10.0/24 to 10.74.0.0/16 inbound, and one just like it for 10.76.0.0/16. I also have an inside exempt statement in reverse, inside, 10.74.0.0/16 to 10.74.10.0/24, and one just like it for 10.76.0.0/16.

On the firewall I have an ACL on the inside from 10.74.0.0/16 to 10.74.10.0/24 permit IP, seems to be working and I see the hit count going up. I have a statement just like it for 10.76.0.0/16 but I never it see it being referenced, sitting at 0 hits.

On the firewall I have an ACL on the outside from outside saying 10.74.10.0/24 to 10.74.0.0/16 permit IP, works and I see the hit count going up, but have a similar statement for 10.76.0.0/16 and same as above, no hits.

I have the default tunneled route set to our inside interface.

I probably have too much allowed currently, or at least a line or two that is unnecessary but if I could get it work then I could step it back down to tighten it up… I’ve tried looking at the logs as well. I’ve logged onto kiwi syslog, monitored it while I attempt to ping 10.76.x.x from a laptop connected to VPN. I never see a deny for it, nor do I even see the 10.76 address anywhere in the log when I do a search. I see the IP of the laptop from where it is talking with our domain controller, where it does it’s initializations and such, but nothing referencing the 10.76 network. I would expect to see an entry somewhere as to where it’s being stopped…but that makes me think it’s not even making it to that point.

I’m sure like usual it’s something small I’m overlooking, but having a fresh set of eyes (or many fresh sets of eyes!) on it might be what it needs. I appreciate the help, thanks!

share|improve this question
    
If your remote office tunnels terminate on the same firewall, then under Device Setup, Interfaces, you need to check "Enable traffic between two or more hosts connected to the same interface". Another thing to look at is the routing table on the laptop when it's connected to that VPN. –  Max Alginin May 25 '11 at 17:17
    
This fixed my issue, how do i mark this as the correct answer? Thanks! –  Don May 27 '11 at 15:47
add comment

1 Answer

up vote 0 down vote accepted

You will need the VPNs to the remote sites to be configured to carry traffic to your mobile VPN range, and the mobile VPN to carry the remote site ranges too: (10.74.10.0/24 <==> 10.76.0.0/16) on both the laptop-cisco and cisco-remote-sites.

If you don't have that on the laptop-cisco VPN then the traffic for the remote sites will never reach the cisco (use "route print" at the command line to find out on Windows), and if you don't have that on the cisco-remote-sites VPNs then the traffic will stop at the cisco, and the remote sites wont know how to send traffic to your laptop because their tunnel policies wont know where 10.74.10.0/24 is.

If another device does the VPNs to remote sites, it may be a simple routing issue - all devices need to route the networks both ways, not just out to the remote sites, but also back again. It sounds more likely to be the tunnel policies though.

share|improve this answer
    
Ahh, "Enable traffic between two or more hosts connected to the same interface" seemed to work, i can now ping the other side! Thank you both for your help! Are there any security concerns with having that checked? I guess that's just how it has to be setup when you have one ASA versus if you were doing site to site? Thanks again! –  Don May 25 '11 at 20:30
    
Sorry, I'm not familiar with that option to say. I'd test if it means one laptop connected by VPN can talk to another connected by VPN, you might not want that happening, for example. –  TessellatingHeckler May 25 '11 at 22:21
    
The option is safe and exists only to maintain the same default behavior as older versions of PIX, where it was absolutely impossible. –  Max Alginin May 26 '11 at 3:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.