Vpn asa 5005:connessione stabilita,ma...

[nerviano]

Per un collegamento VPN da client remoto riesco a stabilire connessione al ASA 5005,ma non riesco ad accedere a nessuna macchina via terminal,nella rete..I server non rispondono nemmeno al ping.

Il problema è sorto da quando ho cambiato gli ip pubblici visto che ho cambiato provider.La connessione ad internet e tutti i servizio di rete funzionano.

Ho visto e rivisto la configurazione e degli ip vecchi nemmeno l'ombra,quindi non ho lasciato nessuna conf appesa.
Non riesco a capire cosa possa essere successo visto che le regole sono rimaste tutte uguali.
Capisco che magari sarebbe meglio allegare la configurazione ,ma al momento non è a portata di mano.

avete qualche idea da suggerirmi???
GRAZIE

[Netrunner]

Controllato per sicurezza split tunneling e nat traversal?


bye,

[risk]

vedere la config ?

[nerviano]

Grazie mille

ASA Version 8.0(2)
!
hostname firewall
domain-name azienda.aziendagroup.it
enable password xxxxxxxxxxx encrypted
names
name 172.16.11.3 AZIENDASRV01 description Server Principale
name 172.16.11.4 AZIENDASRV02 description MailServer
name 172.16.11.249 SWR description Video Interno
name 172.16.11.250 VEGLIA
name 172.16.11.179 PcDesktop description PC Desktop
name 172.16.11.180 PcLaptop description PC Laptop
!
interface Vlan1
nameif inside
security-level 100
ip address 172.16.11.254 255.255.255.0
ospf cost 10
!
interface Vlan2
description Public
nameif outside
security-level 0
ip address 222.222.222.194 255.255.255.248
ospf cost 10
!
interface Vlan5
no forward interface Vlan1
nameif dmz
security-level 50
ip address 172.16.10.254 255.255.255.0
ospf cost 10
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
switchport access vlan 5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd XXXXXXX.XXXXXXX encrypted
ftp mode passive
clock timezone GMT 0
dns server-group DefaultDNS
domain-name AZIENDA.AZIENDAgroup.it
object-group service ere_inline_SERVICE_1
service-object icmp
service-object gre
service-object tcp eq domain
service-object tcp eq www
service-object tcp eq https
service-object tcp eq imap4
service-object tcp eq pop3
service-object tcp eq pptp
service-object tcp eq smtp
service-object udp eq www
service-object udp eq domain
object-group service Navigazione
description Protocolli standard consentiti verso internet
service-object gre
service-object tcp-udp eq domain
service-object tcp eq ftp
service-object tcp eq ftp-data
service-object tcp eq www
service-object tcp eq https
service-object tcp eq imap4
service-object tcp eq pop3
service-object tcp eq pptp
service-object tcp eq smtp
service-object udp eq ntp
object-group service VEGLIA tcp
description Porte in ingresso per VEGLIA
port-object eq 6968
port-object eq 8554
port-object eq www
object-group service ere_inline_TCP_1 tcp
port-object eq https
port-object eq imap4
port-object eq pop3
port-object eq smtp
port-object eq www
object-group service Messenger
description Messenger
service-object tcp-udp range 30000 65535
service-object tcp eq 1863
object-group service WinMx
description WinMx TCP UDP Ports
service-object tcp eq 6699
service-object udp eq 6257
access-list Inside remark Permit all traffic
access-list Inside extended permit ip 172.16.11.0 255.255.255.0 any
access-list outside_access_in remark Accesso alla videocamera interna (SWR)
access-list outside_access_in extended permit tcp any host 222.222.222.195 eq www
access-list outside_access_in remark VPN con ALFA
access-list outside_access_in extended permit gre any host 222.222.222.197
access-list outside_access_in remark Accesso BETA
access-list outside_access_in extended permit tcp host 213.215.247.194 host 222.222.222.196 object-group VEGLIA
access-list outside_access_in remark Accesso GAMMA
access-list outside_access_in extended permit tcp host 225.222.222.31 host 222.222.222.196 object-group VEGLIA
access-list outside_access_in extended permit tcp any host 222.222.222.198 object-group ere_inline_TCP_1
access-list outside_access_in remark Allow All Traffic OUT
access-list outside_access_in extended permit ip host PcLaptop any
access-list outside_access_in remark Allow WinMx IN
access-list outside_access_in extended permit object-group WinMx any host 222.222.222.194
access-list inside_access_in remark Protocolli consentiti
access-list inside_access_in extended permit ip 172.16.11.0 255.255.255.0 any inactive
access-list inside_access_in remark Protocolli permessi in uscita
access-list inside_access_in extended permit object-group Navigazione 172.16.11.0 255.255.255.0 any
access-list inside_access_in remark Allow Messenger
access-list inside_access_in extended permit object-group Messenger 172.16.11.0 255.255.255.0 any inactive
access-list inside_access_in remark Accesso libero dal SWR della Video
access-list inside_access_in extended permit ip host VEGLIA any
access-list inside_access_in remark temp
access-list inside_access_in extended permit ip host 172.16.11.102 any
access-list inside_access_in remark Abilitazione completa in uscita
access-list inside_access_in extended permit ip host AZIENDASRV02 any
access-list inside_access_in remark Accesso da VPN Client
access-list inside_access_in extended permit ip 172.16.11.0 255.255.255.0 192.168.115.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 192.168.115.16 255.255.255.240
access-list dmz_access_in extended permit object-group Navigazione 172.16.10.0 255.255.255.0 any
pager lines 24
logging enable
logging asdm warnings
mtu inside 1500
mtu outside 1500
mtu dmz 1500
ip local pool VPNLAN 192.168.115.20-192.168.115.25 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-602.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
nat (dmz) 1 0.0.0.0 0.0.0.0
static (inside,outside) 222.222.222.195 SWR netmask 255.255.255.255
static (inside,outside) 222.222.222.196 VEGLIA netmask 255.255.255.255
static (inside,outside) 222.222.222.198 AZIENDASRV02 netmask 255.255.255.255
static (inside,outside) 222.222.222.197 AZIENDASRV01 netmask 255.255.255.255
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
access-group dmz_access_in in interface dmz
route outside 0.0.0.0 0.0.0.0 222.222.222.193 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 172.16.11.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA

ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
no crypto isakmp nat-traversal
no vpn-addr-assign dhcp
telnet 172.16.11.0 255.255.255.0 inside
telnet timeout 5
ssh 172.16.11.0 255.255.255.0 inside
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 172.16.10.131-172.16.10.141 dmz
dhcpd dns 222.222.221.220 222.222.221.221 interface dmz
dhcpd enable dmz
!

threat-detection basic-threat
threat-detection statistics
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
group-policy VPNAZIENDA internal
group-policy VPNAZIENDA attributes
dns-server value 172.16.11.3
vpn-tunnel-protocol IPSec
default-domain value AZIENDA.AZIENDAgroup.com
username daitan password xxxxxx.xxxxx encrypted privilege 0
username daitan attributes
vpn-group-policy VPNAZIENDA
username vega password xxxxxxxxxxxx encrypted privilege 0
username vega attributes
vpn-group-policy VPNAZIENDA
tunnel-group VPNAZIENDA type remote-access
tunnel-group VPNAZIENDA general-attributes
address-pool VPNLAN
default-group-policy VPNAZIENDA
tunnel-group VPNAZIENDA ipsec-attributes
pre-shared-key *
prompt hostname context
Cryptochecksum:57ac1e45bc535731a4afa36d675736f6
: end

[ketVet]

Manca lo split tunnell!

[nerviano]

Si posso provare:se mi dici come fare.
Ma mi chiedo allora come ha fatto a funzionare prima che cambiassi gli ip pubblici?
Ho guardato nella vecchia conf è non risulta esserci nemmeno lì.

Grazie

[maufe811]

quello che mi salta all'occhio è il mismatch tra le subnet mask del pool della VPN e dell' acl di nat0

Codice: Seleziona tutto

access-list inside_nat0_outbound extended permit ip any 192.168.115.16 255.255.255.240

ip local pool VPNLAN 192.168.115.20-192.168.115.25 mask 255.255.255.0 

prova a settare la SM del pool a 255.255.255.240 e vedere che succede.
ciao

[nerviano]

si è vero,non avevo notato.
posto il log di un tentativo di accesso con vpn

2|Apr 22 2009|06:55:27|106006|192.168.115.20|192.168.115.255|Deny inbound UDP from 192.168.115.20/137 to 192.168.115.255/137 on interface outside



Grazie
Ciao

[nerviano]

altro log


4|Apr 22 2009|06:55:19|106023|192.168.115.20|AZIENDASRV01|Deny udp src outside:192.168.115.20/58867 dst inside:AZIENDASRV01/53 by access-group "outside_access_in" [0x0, 0x0]




Ciao

[nerviano]

se rifaccio la configurazione VPN ,secondo voi è un casino?

Ciao

[ketVet]

No! ... Se vuoi posso fartela io ... Fammi sapere (anche in pvt)!

[nerviano]

ketVet sei gentilissimo
Fortunatamente ho risolto è bastato dare questi comandi



sysopt connection permit-ipsec


adesso funziona...

Grazie a tutti

[Wizard]

Nn ho letto tutto il topic ma

sysopt connection permit-ipsec

è un comando che permette al firewall di fare passare il traffico vpn senza controllare le acl sulle interfaccie ma sl la crypto map

[nerviano]

Nn ho letto tutto il topic ma

sysopt connection permit-ipsec

è un comando che permette al firewall di fare passare il traffico vpn senza controllare le acl sulle interfaccie ma sl la crypto map

Quindi pecca un pò di sicurezza in questo modo?

[Wizard]

Quindi pecca un pò di sicurezza in questo modo?

Per fare i precisini si ma così in effetti è molto + comodo e nel 90% delle config che ho visto è così.

Di solito quando si vogliono gestire le acl sulle vpn si usano 2 apparati, il primo dove viene terminata la vpn e sotto di lui un firewall che con le acl controlla tutto il traffico. La situazione classica è vpn concentrator e asa \ pix.
Peccato che abbiano mandato in pensione i vpn concentrator.