CISCO ASA 5510, 5505 Creating A VPN Passthrough

Situation

You have installed the CISCO ASA in your organization, configured the NAT so that all of your own computers are protected behind the NAT and Firewall but now some users want to use a VPN to connect to some network outside. For example, a visiting or partner employee may want to connect back to their corporate office via an IPSEC VPN.

The VPN login seems to work, but nothing gets connected.

Why Does This Not Work On Out of The Box Usually?

Because of Network Address Translation, the VPN IP addresses gets translated through the firewall.

Possible Solution

The CISCO support web site has a very comprehensive information on this. The URL to the support article is this.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008045a2d2.shtml

This article also shows you how to configure this situation using the ASDM User Interface. But I know you don't want to read that so in summary here is what you would do:

• Click Configuration on the Top Toolbar
• On the side tool bar is "Security Policy"
• Add the Following Access Rules (Access Rules Tab)
• Add and/or Activate esp protocol in IP from the outside to the inside interface, Source is outside and destination is inside.
• Add and/or Activate isakmp UDP protocol, source outside, destination the inside interface
• Add and/or Activate UDP port 4500 traffic from source outside, destination the inside interface

Status

We've implemented this in April 08, it is June now and has been working very well in our environment. We've tried the "regular" CISCO VPN client connecting to the outside as well as CheckPoint ScruRemote VPN clients with it.

CISCO ASA and Getting Mac/Windows L2TP To Work

Symptom:

You used the VPN Wizard in CISCO ASA's ASDM to create an L2TP configuration, but it does not work.

You look at the ASA Log and it says something to the effect that no acceptable SAs.

What Fixed:

Know that the Mac and PC will connect through the DefaultRAGroup therefore if you are doing a pre-shared key, it must be set right there. If you are not going through Phase 1, check that first.

If you are going through the Pase 1 then you are likely that the TRANSPORT mode of IPSec is not included in your Dynamic IPSec policy.

Check the following,

crypto dynamic-map Extranet_dyn_map 20 set transform-set TRANS_ESP_3DES_SHA ESP-AES-256-MD5 ESP-3DES-SHA

Finally if you are using the user account with the ASA itself, then the user password must be encrypted using nt-encrypted keyword. I would just telnet to the ASA and type that in. I am not sure if you are using both the CISCO client and L2TP, both ASA native mode of encryption and the nt encryption are allowed, so I have created a second user name for the purpose of logging on via L2TP.

username bozo password xyzzy nt-encrypted

Total Time To Figure Out This Issue

Approximately 4 hours.