- Posts: 14
- Thank you received: 0
ASA VPN - Tunnel forms but no access to inside.
16 years 11 months ago #24116
by Torvald
Replied by Torvald on topic Re: ASA VPN - Tunnel forms but no access to inside.
I know it's a mess and I don't know why split tunnel is on. As far as I know no VPN is working. I'm trying to clean this thing up but first I need to get the VPN working for the IT group to use. I can NOT blow this away and start over at this time as this is a production firewall.
I really need help on this, this mess is very confusing and I know a lot of it is not functional or at least not in a usefull way.
I really need help on this, this mess is very confusing and I know a lot of it is not functional or at least not in a usefull way.
16 years 11 months ago #24117
by Torvald
Replied by Torvald on topic Re: ASA VPN - Tunnel forms but no access to inside.
Alright I got it working, or so it seems (natting issue fixed with BOLDED line below). now I need to figure out what of these rules are un needed so I can clean this mess up some.
access-list Inside_cryptomap extended permit ip any 10.125.1.96 255.255.255.224
access-list nat0 extended permit ip any 10.125.1.96 255.255.255.224
access-list nat0 extended permit ip 10.125.1.0 255.255.255.0 10.0.0.0 255.0.0.0
access-list nonat_dmz extended permit ip any 10.125.1.96 255.255.255.224
access-list BW-VPN_splitTunnelAcl standard permit any
access-list management_nat0_outbound extended permit ip any 10.125.1.96 255.255.255.224
access-list Outside_cryptomap extended permit ip any 10.125.1.96 255.255.255.224
ip local pool BW-VPN 10.125.1.100-10.125.1.125
nat (Inside) 0 access-list nat0
nat (Inside) 1 0.0.0.0 0.0.0.0
nat (DMZ) 0 access-list nonat_dmz
nat (DMZ) 1 0.0.0.0 0.0.0.0
nat (management) 0 access-list management_nat0_outbound
access-group Outside_access_in in interface Outside
access-group DMZ_access_in in interface DMZ
access-list Inside_cryptomap extended permit ip any 10.125.1.96 255.255.255.224
access-list nat0 extended permit ip any 10.125.1.96 255.255.255.224
access-list nat0 extended permit ip 10.125.1.0 255.255.255.0 10.0.0.0 255.0.0.0
access-list nonat_dmz extended permit ip any 10.125.1.96 255.255.255.224
access-list BW-VPN_splitTunnelAcl standard permit any
access-list management_nat0_outbound extended permit ip any 10.125.1.96 255.255.255.224
access-list Outside_cryptomap extended permit ip any 10.125.1.96 255.255.255.224
ip local pool BW-VPN 10.125.1.100-10.125.1.125
nat (Inside) 0 access-list nat0
nat (Inside) 1 0.0.0.0 0.0.0.0
nat (DMZ) 0 access-list nonat_dmz
nat (DMZ) 1 0.0.0.0 0.0.0.0
nat (management) 0 access-list management_nat0_outbound
access-group Outside_access_in in interface Outside
access-group DMZ_access_in in interface DMZ
Time to create page: 0.122 seconds