Matt
Take me down to the paradise city
Premium
join:2003-07-20
Jamestown, NC
 ·North State Commun..
1 edit | reply to Pluto1914
Re: [Other] Static Route Question
Unfortunately, your post isn't very clear, so we'll need some more information.
First, what is the "server?" What OS? What does it do?
Secondly, what is handling your VPN connectivity?
Thirdly, if I understand your post correctly, it looks like you have a "work" network and some "other" network. The VPN connects to the "other" network. Does the "work" network and the "other" network have any sort of physical connectivity? |
|
Pluto1914
join:2004-02-16
Westminster, MA
 ·Comcast
| The Server - Windows XP Pro SP3. Runs the AVLS server application which receives the location data from the modems and translate that to its mapping software for tracking.
The VPN connection is handled via the Cisco ASA Firewall
There are three networks involved in this setup.
The VZW network with the DUN Modem.
The work LAN where the server sits.
Finally the VPN network which has full access to the LAN for the server.
I hope this helps. |
|
Matt
Take me down to the paradise city
Premium
join:2003-07-20
Jamestown, NC | That does clarify. One more thing, when you say you want the VPN users access to "the client," you mean the XP machine correct? |
|
Pluto1914
join:2004-02-16
Westminster, MA | Thats right. The bosses can be out and about and they want the ability to fire up the VPN and use the AVL client like they are sitting at their desks. |
|
Matt
Take me down to the paradise city
Premium
join:2003-07-20
Jamestown, NC
·North State Commun..
1 edit | said by Pluto1914  :Thats right. The bosses can be out and about and they want the ability to fire up the VPN and use the AVL client like they are sitting at their desks. Your ASA should take care of the routes for you. When a user connects to the ASA, can they not access the XP machine already? |
|
Pluto1914
join:2004-02-16
Westminster, MA | No, as I thought they should. But I have even tried adding rules to allow bidirectional communication between the two networks on all ports and so far...nothing |
|
Matt
Take me down to the paradise city
Premium
join:2003-07-20
Jamestown, NC
·North State Commun..
1 edit | said by Pluto1914 :No, as I thought they should. But I have even tried adding rules to allow bidirectional communication between the two networks on all ports and so far...nothing I don't think a static route is the answer here. It sounds to me like your ASA or the Cisco VPN Client may be misconfigured. Let me see if I can get this moved to the Cisco or Enterprise Admins forum for you. |
|
tubbynet
reminds me of the danse russe
Premium
join:2008-01-16
Chandler, AZ
·Cox HSI
 ·Callcentric
 ·Sprint Mobile Broa..
·FrontierNet Intern..
| reply to Pluto1914
said by Pluto1914 :But I have even tried adding rules to allow bidirectional communication between the two networks on all ports and so far...nothing the asa isn't looking for firewall rules to permit traffic. two things *must* be enabled for proper communication across vpn (aside from the usual connection ike phase i and ii stuff).
(a) you must allow the subnet to be tunneled across the vpn if you are using a split-tunnel vpn. if your client isn't made aware of the network (or specific device) then it will never know to pass packets across the vpn interface
(b) the subnet or host *must* be nat exempt in the access-list referenced by the nat0 statement to the vpn subnet (i.e. if your vpn is connected on 1.1.1.1 and your client is 2.2.2.2, then you must deny nat from 1.1.1.1 to 2.2.2.2, otherwise communication won't work).
its hard to speculate what is messed up without seeing the config. this is more appropriate in the cisco forums, however.
you may also try googling for the cisco asa configuration guide for your version of the asa-os. it should have a good reference to get you started on configuring the vpn.
q.
--
"...if I in my north room dance naked, grotesquely before my mirror waving my shirt round my head and singing softly to myself..." |
|
Matt
Take me down to the paradise city
Premium
join:2003-07-20
Jamestown, NC
·North State Commun..
| said by tubbynet :its hard to speculate what is messed up without seeing the config. this is more appropriate in the cisco forums, however. I sent a Hey Mod and asked it to be moved, but it never was. Would you mind sending one as well? |
|
tubbynet
reminds me of the danse russe
Premium
join:2008-01-16
Chandler, AZ
·Cox HSI
·Callcentric
·Sprint Mobile Broa..
·FrontierNet Intern..
1 edit | said by Matt :Would you mind sending one as well? done and done. though i would think that you have a little more pull since you've been here longer  .
i'm just a newcomer.... 
q.
--
"...if I in my north room dance naked, grotesquely before my mirror waving my shirt round my head and singing softly to myself..." |
|
Matt
Take me down to the paradise city
Premium
join:2003-07-20
Jamestown, NC
·North State Commun..
| said by tubbynet :said by Matt :Would you mind sending one as well? done and done. though i would think that you have a little more pull since you've been here longer . i'm just a newcomer.... q. Eh, that's doubtful. Perhaps the mod didn't think it should have been moved since I was the only one who responded. I appreciate it. |
|
