Pluto1914
join:2004-02-16
Westminster, MA | reply to Matt
Re: [Other] Static Route Question
No, as I thought they should. But I have even tried adding rules to allow bidirectional communication between the two networks on all ports and so far...nothing |
|
Matt
Take me down to the paradise city
Premium
join:2003-07-20
Jamestown, NC
 ·North State Commun..
1 edit | said by Pluto1914  :No, as I thought they should. But I have even tried adding rules to allow bidirectional communication between the two networks on all ports and so far...nothing I don't think a static route is the answer here. It sounds to me like your ASA or the Cisco VPN Client may be misconfigured. Let me see if I can get this moved to the Cisco or Enterprise Admins forum for you. |
|
tubbynet
reminds me of the danse russe
Premium
join:2008-01-16
Chandler, AZ
 ·Cox HSI
 ·Callcentric
 ·Sprint Mobile Broa..
·FrontierNet Intern..
| reply to Pluto1914
said by Pluto1914 :But I have even tried adding rules to allow bidirectional communication between the two networks on all ports and so far...nothing the asa isn't looking for firewall rules to permit traffic. two things *must* be enabled for proper communication across vpn (aside from the usual connection ike phase i and ii stuff).
(a) you must allow the subnet to be tunneled across the vpn if you are using a split-tunnel vpn. if your client isn't made aware of the network (or specific device) then it will never know to pass packets across the vpn interface
(b) the subnet or host *must* be nat exempt in the access-list referenced by the nat0 statement to the vpn subnet (i.e. if your vpn is connected on 1.1.1.1 and your client is 2.2.2.2, then you must deny nat from 1.1.1.1 to 2.2.2.2, otherwise communication won't work).
its hard to speculate what is messed up without seeing the config. this is more appropriate in the cisco forums, however.
you may also try googling for the cisco asa configuration guide for your version of the asa-os. it should have a good reference to get you started on configuring the vpn.
q.
--
"...if I in my north room dance naked, grotesquely before my mirror waving my shirt round my head and singing softly to myself..." |
|
Matt
Take me down to the paradise city
Premium
join:2003-07-20
Jamestown, NC
·North State Commun..
| said by tubbynet :its hard to speculate what is messed up without seeing the config. this is more appropriate in the cisco forums, however. I sent a Hey Mod and asked it to be moved, but it never was. Would you mind sending one as well? |
|
tubbynet
reminds me of the danse russe
Premium
join:2008-01-16
Chandler, AZ
·Cox HSI
·Callcentric
·Sprint Mobile Broa..
·FrontierNet Intern..
1 edit | said by Matt :Would you mind sending one as well? done and done. though i would think that you have a little more pull since you've been here longer  .
i'm just a newcomer.... 
q.
--
"...if I in my north room dance naked, grotesquely before my mirror waving my shirt round my head and singing softly to myself..." |
|
Matt
Take me down to the paradise city
Premium
join:2003-07-20
Jamestown, NC
·North State Commun..
| said by tubbynet :said by Matt :Would you mind sending one as well? done and done. though i would think that you have a little more pull since you've been here longer . i'm just a newcomer.... q. Eh, that's doubtful. Perhaps the mod didn't think it should have been moved since I was the only one who responded. I appreciate it. |
|
