• Advertisement

ASA5510 Remote access Server problem

IPsec, L2TP, Split tunneling, PPTP and all other VPN related posts.

ASA5510 Remote access Server problem

Postby Guest » Tue Dec 07, 2010 3:03 pm


Hello guys,

I have a problem with ASA5510 configured as Remote access server. We are using Windows XP VPN client. Staring at the configuration I don't see any problem but when I try to connect to the Server it doesn't initiate VPN negotiation. I had problem like this before, but at least I saw traffic hitting the ASA. Now I don't see anything hitting the device. I am attaching the current configuration of the ASA. The VPN client on my laptop is configured properly. Thank you in advance!

rvr

 

Guest
 

Advertisement

Re:ASA5510 Remote access Server problem

Postby Guest » Tue Dec 07, 2010 3:20 pm


Hi,

In your configuration, you have the below command, which will disable IKE and ESP.

no sysopt connection permit-vpn.

Can you enable this command and run the testing again.

http://www.cisco.com/en/US/docs/security/asa/asa72/command/reference/s8_72.html#wp1198155

If you really want to disable this option, then you need to explicitly configure Access-list applied inbound to permit all ISAKMP and IPSEC ports and also the user traffic.

Regards,

Arul

*Pls rate if it helps*

Guest
 

Re:ASA5510 Remote access Server problem

Postby Guest » Tue Dec 07, 2010 3:46 pm


I had the command in the configuration before and didn't work. Now I inserted it onace again(according to your suggestion) and it worked, this is strange.

Is this command mandatory for ASA remote access server?

rvr

Guest
 

Re:ASA5510 Remote access Server problem

Postby Guest » Tue Dec 07, 2010 4:48 pm


Hi,

Glad to help and thanks for rating.

This command is not mandatory but 90% of the deployment that I have seen has this command configured and is the default for ASA. In a nutshell, what this command does is open IKE and IPSEC ports and also does not check inbound  ACL on ASA for IPSEC Traffic.

In case if you dont have this command enabled, you need to configure inbound ACL to permit IKE, IPSEC and Clear Text Remote Access VPN Traffic after the IPSEC Packets get decrypted on the ASA.

Regards,

Arul

*Pls rate if it helps*

Guest
 

Re: ASA5510 Remote access Server problem

Postby john » Thu May 19, 2011 10:54 am

Thanks
john
Site Admin
 
Posts: 18
Joined: Wed Apr 27, 2011 8:06 pm

Next


  • Advertisement


Similar topics


Return to Virtual Private Networks

Who is online

Users browsing this forum: No registered users and 4 guests