Cisco ASA 5505 Remote Client

[Hatric]

Hei, er det noen som kan hjelpe meg?

Jeg har brukt vpn veiviser i asa'n, men jeg får ikke kontakt med det lokale nettverket jeg bruker cisco client v5.0 og jeg får logget meg men der stopper det

 

Her er konfigen

 

: Saved

:

ASA Version 7.2(2)

!

hostname ciscoasa

domain-name default.domain.invalid

enable password xxxxxxxxxxxxxxxx encrypted

names

!

interface Vlan1

nameif inside

security-level 100

ip address 192.168.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passwd xxxxxxxxxxxxxxxx encrypted

ftp mode passive

clock timezone CEST 1

clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00

dns server-group DefaultDNS

domain-name default.domain.invalid

access-list vpn-client_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

ip local pool vpn-client-pool 192.168.0.50-192.168.0.100 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

icmp permit any inside

asdm image disk0:/asdm-522.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

group-policy vpn-client internal

group-policy vpn-client attributes

vpn-tunnel-protocol IPSec

split-tunnel-policy tunnelspecified

split-tunnel-network-list value vpn-client_splitTunnelAcl

username xxx1 password /xxxxxxx.xxxxxxx encrypted privilege 0

username xxx1 attributes

vpn-group-policy vpn-client

http server enable

http 192.168.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto dynamic-map outside_dyn_map 20 set pfs

crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map interface outside

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

tunnel-group vpn-client type ipsec-ra

tunnel-group vpn-client general-attributes

address-pool vpn-client-pool

default-group-policy vpn-client

tunnel-group vpn-client ipsec-attributes

pre-shared-key *

telnet xxx.xxx.xxx.xxx 255.255.255.255 outside

telnet xxx.xxx.xxx.xxx 255.255.255.255 outside

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd auto_config outside

!

dhcpd address 192.168.1.2-192.168.1.33 inside

dhcpd enable inside

!

 

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect pptp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:d8726ad7b026e6755824d25e969c6bdf

: end

asdm image disk0:/asdm-522.bin

no asdm history enable

[bruker456281]

Du har satt opp RDP-serveren, slik at den vil motta FW's IP?

 

Vis ikke så kan jeg maile deg en pdf-fil med konfigurasjonen for hele VPN biten, det ligger jo forsåvidt en "guide" på Cisco sine sider. Selv om deres guider er akk så tungvinte og trasige :-P

[ANORIUS]

Sett VPN klientene og det lokale nettet ditt i to forskjellige subnet og settopp Nat 0 (nat exemption) mellom subnettene. ellers så ser alt greit ut.