Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've setup a Remote Access VPN on my Cisco ASA 5505. I'm able to connect to my ASA via my phone or the Cisco client, but I'm unable to reach devices in my inside LAN when connected via VPN.

The setup is the following:

Inside Network : 10.0.0.0/24 VPN_POOL: 172.16.0.0/24 Outside Network: 192.168.1.0/24

ASA is not the perimeter router, there is another device on the 192.168.1.0/24 network which is connected to my cable provider. Obviously UDP port 500 and 4500 are forwarded to the ASA's outside interface. Everything works perfectly, besides the VPN stuff. Config:

interface Vlan1
nameif inside
security-level 100
ip address 10.0.0.254 255.255.255.0

interface Vlan2
description Outside Interface
nameif outside
security-level 0
address 192.168.1.254 255.255.255.0 

object network VPNPOOL
subnet 172.16.0.0 255.255.255.0

object network INSIDE_LAN
subnet 10.0.0.0 255.255.255.0

Then the exempt NAT rule.

nat (inside,outside) source static INSIDE_LAN INSIDE_LAN destination static VPNPOOL VPNPOOL

I don't think that the problem is with the VPN config, as I can successfully establish the VPN connection, but just in case I post it here:

group-policy ZSOCA_ASA internal
group-policy ZSOCA_ASA attributes
vpn-tunnel-protocol ikev1 
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Split-Tunnel
default-domain value default.domain.invalid

tunnel-group ZSOCA_ASA type remote-access
tunnel-group ZSOCA_ASA general-attributes
address-pool VPNPOOL
default-group-policy ZSOCA_ASA
tunnel-group ZSOCA_ASA ipsec-attributes
ikev1 pre-shared-key *****

Any ideas are welcome. Regards.

share|improve this question
    
Is there a policy or access list that then permits the VPN user to the destination resource? –  SpacemanSpiff Nov 17 '12 at 21:20
    
Actually I created any ACL allowing ip and icmp from the VPNPOOL to the Inside LAN. But just checked the config, and it is not there. I'll recreate and check. I'll let you know my findings. –  chickenloop Nov 17 '12 at 21:27
    
Checked, created but it did not solve the problem. –  chickenloop Nov 17 '12 at 21:33
    
This has been solved. The problem was not with the asa but there was no default gw configured on the Linux box, on the inside network..... –  chickenloop Nov 17 '12 at 22:12
    
Are you still having issues with this? –  bluedogs May 8 '13 at 1:02

1 Answer 1

can you please check the routing on your inside server ? check Default Gateway or if there is routing configured on the server itself

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.