CISCO ASA 5510, 5505 Creating A VPN Passthrough

Situation

You have installed the CISCO ASA in your organization, configured the NAT so that all of your own computers are protected behind the NAT and Firewall but now some users want to use a VPN to connect to some network outside. For example, a visiting or partner employee may want to connect back to their corporate office via an IPSEC VPN.

The VPN login seems to work, but nothing gets connected.

Why Does This Not Work On Out of The Box Usually?

Because of Network Address Translation, the VPN IP addresses gets translated through the firewall.

Possible Solution

The CISCO support web site has a very comprehensive information on this. The URL to the support article is this.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008045a2d2.shtml

This article also shows you how to configure this situation using the ASDM User Interface. But I know you don't want to read that so in summary here is what you would do:

• Click Configuration on the Top Toolbar
• On the side tool bar is "Security Policy"
• Add the Following Access Rules (Access Rules Tab)
• Add and/or Activate esp protocol in IP from the outside to the inside interface, Source is outside and destination is inside.
• Add and/or Activate isakmp UDP protocol, source outside, destination the inside interface
• Add and/or Activate UDP port 4500 traffic from source outside, destination the inside interface

Status

We've implemented this in April 08, it is June now and has been working very well in our environment. We've tried the "regular" CISCO VPN client connecting to the outside as well as CheckPoint ScruRemote VPN clients with it.

CISCO ASA 5510, 5505 VPN Removing peer from peer table failed, no match! Error

Symptom

When you try to connect CISCO VPN client you get this error in the log and it will not connect.

4 Sep 13 2007 11:05:12 713903 Group = DefaultRAGroup, IP = xxx.xxx.xxx.xxx, Error: Unable to remove PeerTblEntry

3 Sep 13 2007 11:05:12 713902 Group = DefaultRAGroup, IP = xxx.xxx.xxx.xxx, Removing peer from peer table failed, no match!

Possible Cause

This error message is misleading and leads you to beleive there is something really wrong about your configuration.

But it could simply mean that there is a mismatch, miss-spelling or missing entry the Group ID that is configured on the CISCO VPN client and the Group ID on the Tunnel Group setting.

I guess that the ASA is picking up the default group policy as it is not finding the correct one.

Solution

Check under the tunnel group in your running configuration.

tunnel-group type ipsec-ra

Go to the CISCO VPN client, go to the Authentication tab and the Name field must match what you used in