ASA5510 Remote access Server problem

IPsec, L2TP, Split tunneling, PPTP and all other VPN related posts.
Guest

ASA5510 Remote access Server problem

Post by Guest » Tue Dec 07, 2010 3:03 pm


Hello guys, I have a problem with ASA5510 configured as Remote access server. We are using Windows XP VPN client. Staring at the configuration I don't see any problem but when I try to connect to the Server it doesn't initiate VPN negotiation. I had problem like this before, but at least I saw traffic hitting the ASA. Now I don't see anything hitting the device. I am attaching the current configuration of the ASA. The VPN client on my laptop is configured properly. Thank you in advance! rvr  

Alt+MAlt+N
Guest

Re:ASA5510 Remote access Server problem

Post by Guest » Tue Dec 07, 2010 3:20 pm


Hi,In your configuration, you have the below command, which will disable IKE and ESP. no sysopt connection permit-vpn. Can you enable this command and run the testing again.http://www.cisco.com/en/US/docs/securit ... p1198155If you really want to disable this option, then you need to explicitly configure Access-list applied inbound to permit all ISAKMP and IPSEC ports and also the user traffic. Regards,Arul*Pls rate if it helps*

Guest

Re:ASA5510 Remote access Server problem

Post by Guest » Tue Dec 07, 2010 3:46 pm


I had the command in the configuration before and didn't work. Now I inserted it onace again(according to your suggestion) and it worked, this is strange.Is this command mandatory for ASA remote access server?rvr

Guest

Re:ASA5510 Remote access Server problem

Post by Guest » Tue Dec 07, 2010 4:48 pm


Hi,Glad to help and thanks for rating. This command is not mandatory but 90% of the deployment that I have seen has this command configured and is the default for ASA. In a nutshell, what this command does is open IKE and IPSEC ports and also does not check inbound  ACL on ASA for IPSEC Traffic. In case if you dont have this command enabled, you need to configure inbound ACL to permit IKE, IPSEC and Clear Text Remote Access VPN Traffic after the IPSEC Packets get decrypted on the ASA. Regards,Arul*Pls rate if it helps*

john
Site Admin
Posts: 19
Joined: Wed Apr 27, 2011 8:06 pm

Re: ASA5510 Remote access Server problem

Post by john » Thu May 19, 2011 10:54 am

Thanks

Post Reply