Re: [c-nsp] ASA 5520 Remote Access VPN

2009-02-04 Thread Eimantas Zdanevičius
Sigurbjörn Birkir Lárusson wrote: It shouldn't be sending you a default route at all, just the tunnel routes BR, Sibbi Problem solved. Default route was overrided by linux NetworkManager (vpnc) software on vpnclient machine. I need to set 'Use this connection only for resources on this n

Re: [c-nsp] ASA 5520 Remote Access VPN

2009-02-04 Thread Sigurbjörn Birkir Lárusson
It shouldn't be sending you a default route at all, just the tunnel routes BR, Sibbi On 4.2.2009 14:05, "Eimantas Zdanevičius" wrote: > Sigurbjörn Birkir Lárusson wrote: >> Hmm, assuming you are using the Cisco VPN client you shouldn't be getting a >> default if the split-tunnel configuration

Re: [c-nsp] ASA 5520 Remote Access VPN

2009-02-04 Thread Eimantas Zdanevičius
Sigurbjörn Birkir Lárusson wrote: Hmm, assuming you are using the Cisco VPN client you shouldn't be getting a default if the split-tunnel configuration is working http://www.cisco.com/en/US/products/ps6120/products_configuration_example091 86a0080702999.shtml#s2 Has pretty good ASDM instruction

Re: [c-nsp] ASA 5520 Remote Access VPN

2009-02-04 Thread Sigurbjörn Birkir Lárusson
Hmm, assuming you are using the Cisco VPN client you shouldn't be getting a default if the split-tunnel configuration is working http://www.cisco.com/en/US/products/ps6120/products_configuration_example091 86a0080702999.shtml#s2 Has pretty good ASDM instructions on how to do this, I don't use the

Re: [c-nsp] ASA 5520 Remote Access VPN

2009-02-03 Thread Eimantas Zdanevičius
Sigurbjörn Birkir Lárusson wrote: Something along these lines if you wanted to just send 10.10.53.0/24 and 10.10.54.0/24 through the VPN tunnel tunnel-group testgroup general-attributes default-group-policy testpolicy group-policy testpolicy internal group-policy testpolicy attributes s

Re: [c-nsp] ASA 5520 Remote Access VPN

2009-02-03 Thread Sigurbjörn Birkir Lárusson
Something along these lines if you wanted to just send 10.10.53.0/24 and 10.10.54.0/24 through the VPN tunnel tunnel-group testgroup general-attributes default-group-policy testpolicy group-policy testpolicy internal group-policy testpolicy attributes split-tunnel-policy tunnelspecified

Re: [c-nsp] ASA 5520 Remote Access VPN

2009-02-03 Thread Eimantas Zdanevičius
Sigurbjörn Birkir Lárusson wrote: If you're connecting through a natted host to the VPN you might try adding crypto isakmp nat-traversal 30 I have a fairly similar setup to yours which works just fine. This solved the problem, thanks! Another problem is that client sets default gateway to

Re: [c-nsp] ASA 5520 Remote Access VPN

2009-02-03 Thread Sigurbjörn Birkir Lárusson
If you're connecting through a natted host to the VPN you might try adding crypto isakmp nat-traversal 30 I have a fairly similar setup to yours which works just fine. BR, Sibbi III On 3.2.2009 14:33, "Eimantas Zdanevičius" wrote: > Engelhard Labiro wrote: >>> hostname(config)# ip local poo

Re: [c-nsp] ASA 5520 Remote Access VPN

2009-02-03 Thread Sigurbjörn Birkir Lárusson
Not unless you configure RRI, see http://www.cisco.com/en/US/products/ps6120/products_configuration_example091 86a00809d07de.shtml BR, Sibbi On 3.2.2009 14:33, "Eimantas Zdanevičius" wrote: > Engelhard Labiro wrote: >>> hostname(config)# ip local pool testpool 192.168.0.10-192.168.0.15 >>>

Re: [c-nsp] ASA 5520 Remote Access VPN

2009-02-03 Thread Eimantas Zdanevičius
Engelhard Labiro wrote: hostname(config)# ip local pool testpool 192.168.0.10-192.168.0.15 I guess this is a routing problem, since you assign 192.168.0.x to vpn client which is located on different segment with PIX's own interface. The pix must response to arp request for 192.168.0.10 to

Re: [c-nsp] ASA 5520 Remote Access VPN

2009-02-03 Thread Engelhard Labiro
> hostname(config)# ip local pool testpool 192.168.0.10-192.168.0.15 I guess this is a routing problem, since you assign 192.168.0.x to vpn client which is located on different segment with PIX's own interface. The pix must response to arp request for 192.168.0.10 to 15 on behalf of the vpn clien

Re: [c-nsp] ASA 5520 Remote Access VPN

2009-02-03 Thread Eimantas Zdanevičius
Peter Rathlev wrote: ... What does the log say? Where's the ACLs for the interfaces? Are you sure the firewall isn't denying the traffic as it does default? Regards, Peter Its hard to find anything in log, because this is a production firewall and there is a lot of messages in syslog. if i'

Re: [c-nsp] ASA 5520 Remote Access VPN

2009-02-03 Thread Eimantas Zdanevičius
Alasdair Gow wrote: Hi, It looks like eth0 and eth1 are on the same network. they need to be on separate networks IIRC. Cheers, Ally sorry about my mistake. interfaces are on diferent networks maske are 255.255.255.0 ___ cisco-nsp mailing list ci

Re: [c-nsp] ASA 5520 Remote Access VPN

2009-02-03 Thread Peter Rathlev
On Tue, 2009-02-03 at 11:12 +0200, Eimantas Zdanevičius wrote: > I have configured vpn on asa 5520 (software version 7.2). vpnclient > connect to asa and says everything is ok. But i cannot ping any computer > in inside network. > > asa is working in router mode, single context. No nat on inside

[c-nsp] ASA 5520 Remote Access VPN

2009-02-03 Thread Eimantas Zdanevičius
Hi all, I have configured vpn on asa 5520 (software version 7.2). vpnclient connect to asa and says everything is ok. But i cannot ping any computer in inside network. asa is working in router mode, single context. No nat on inside or outside interface hostname(config)# interface ethernet0