I'm using an ASA 5510 for a large network containing multiple subnets, some of which (wireless) have limited network access. I'd like to allow the wireless users to be able to VPN in for full network access, however none of the hosts on the inside network are able to connect to the VPN, or even ping the ASA external interface.

I'm assuming this has something to do with my NAT rules getting in the way. Can anyone point me in the right direction?

Here's the running-config (sanitized): http://pastebin.com/snN4AVSA

packet-tracer ping from inside to outside: http://pastebin.com/hX8X8kTr

  • if the wireless VLAN is already "inside the firewall" wouldn't it be better to focus on internal routing and ACLs then to mess with going out and back in the firewall? – TheCleaner Apr 18 '12 at 19:33
  • Yes, it is "inside the firewall", but wireless is shared with untrusted users, e.g., a contractor in the building. The router has no idea if a user is trusted or not, hence the VPN for access. – ben lemasurier Apr 18 '12 at 19:38
  • That's where either separate SSID's with ACLs come in or 802.1X or similar. – TheCleaner Apr 18 '12 at 19:45
  • yeah, that crossed my mind but it seems far more complicated than simply allowing VPN access. – ben lemasurier Apr 18 '12 at 19:50
  • what is supplying wireless currently? Perhaps we can help you setup the wireless properly. – TheCleaner Apr 18 '12 at 19:57

You won't be able to access your VPN from inside network due to routing.

  • Can you explain further? I previously accomplished this using a Cisco 2821 (non-asa). – ben lemasurier Apr 18 '12 at 19:34
  • I've tried to do that few times and I was not able to accomplished that (tried it w/: PIX, ASA). I can't really give you too many details as I guess I dont understand that well myself, but as far as I know it's just simply not possible. I'm surprised to hear that you were able to get it to work w/ 2821 – alexus Apr 18 '12 at 19:39

No luck here or on the Cisco forums, I'm still convinced this is possible, though. Oh well, in any event I ended up creating a separate VLAN for secured 802.1x wireless.


I think the easiest way to achieve what you want would be to connect your Access Points outside the ASA, or in some sort of DMZ. Then you are not trying to do something too different from the norm - e.g. give VPN access to clients outside the secure network, while keeping untrusted clients out.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.