I have configured my ASA5510 for remote access VPN and everything works fine, but the client doesn't get the internal DNS servers and therefore cannot ping, etc. but hostname.
I am using the 4.6.02.0011 client and the ASA config is as follows: ... interface Ethernet0/1 nameif dsl1 security-level 0 ip address ***** 255.255.255.248 ... interface Ethernet0/3 nameif secure_lan security-level 100 ip address 10.1.2.254 255.255.255.0 ... dns timeout 30 dns domain-lookup secure_lan dns name-server 10.1.1.11 access-list dsl1_to_lan extended permit icmp any any echo-reply access-list dsl1_to_lan extended permit icmp any any time-exceeded access-list dsl1_to_lan extended permit icmp any any unreachable access-list ballard_to_vietnam extended permit ip 10.1.0.0 255.255.0.0 172.16.51.0 255.255.255.192 access-list inside_nat0_outside extended permit ip 10.1.0.0 255.255.0.0 172.16.51.0 255.255.255.192 access-list inside_nat0_outside extended permit ip 10.1.1.0 255.255.255.0 10.1.10.0 255.255.255.0 access-list inside_nat0_outside extended permit ip 10.1.2.0 255.255.255.0 10.1.10.0 255.255.255.0 access-list inside_nat0_outside extended permit ip 10.1.3.0 255.255.255.0 10.1.10.0 255.255.255.0 access-list inside_nat0_outside extended permit ip 10.68.150.0 255.255.255.0 10.1.10.0 255.255.255.0 access-list inside_nat0_outside extended permit ip 192.168.252.0 255.255.255.240 10.1.10.0 255.255.255.0 ... ip local pool vpnclient 10.1.10.10-10.1.10.50 ... global (dsl1) 1 63.226.226.140 netmask 255.255.255.248 nat (secure_lan) 0 access-list inside_nat0_outside nat (secure_lan) 1 0.0.0.0 0.0.0.0 access-group dsl1_to_lan in interface dsl1 route dsl1 0.0.0.0 0.0.0.0 63.226.226.142 1 route secure_lan 192.168.252.0 255.255.255.0 10.1.2.1 1 route secure_lan 10.68.150.0 255.255.255.0 10.1.2.1 1 route secure_lan 10.1.4.0 255.255.255.0 10.1.2.1 1 route secure_lan 10.1.3.0 255.255.255.0 10.1.2.1 1 route secure_lan 10.1.1.0 255.255.255.0 10.1.2.1 1 ... aaa-server vpn protocol radius aaa-server vpn (secure_lan) host 10.1.1.11 key * group-policy vpn3000 internal group-policy vpn3000 attributes dns-server value 10.1.1.11 wins-server value 10.1.1.11 vpn-tunnel-protocol IPSec default-domain value gw webvpn ... http server enable http 10.1.1.0 255.255.255.0 secure_lan http 10.1.10.0 255.255.255.0 secure_lan ... crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec transform-set VPN-SET esp-3des esp-md5-hmac crypto dynamic-map dynmap 10 set transform-set VPN-SET crypto dynamic-map dynmap 10 set reverse-route crypto map vietnam_map 20 match address ballard_to_vietnam crypto map vietnam_map 20 set peer ***** crypto map vietnam_map 20 set transform-set ESP-3DES-MD5 crypto map vpnmap 10 ipsec-isakmp dynamic dynmap crypto map vpnmap interface dsl1 isakmp enable dsl1 isakmp policy 10 authentication pre-share isakmp policy 10 encryption 3des isakmp policy 10 hash md5 isakmp policy 10 group 2 isakmp policy 10 lifetime 1000 isakmp policy 20 authentication pre-share isakmp policy 20 encryption 3des isakmp policy 20 hash md5 isakmp policy 20 group 2 isakmp policy 20 lifetime 86400 isakmp policy 65535 authentication pre-share isakmp policy 65535 encryption 3des isakmp policy 65535 hash sha isakmp policy 65535 group 2 isakmp policy 65535 lifetime 86400 tunnel-group 222.255.70.60 type ipsec-l2l tunnel-group 222.255.70.60 ipsec-attributes pre-shared-key * tunnel-group vpn3000 type ipsec-ra tunnel-group vpn3000 general-attributes address-pool vpnclient authentication-server-group vpn tunnel-group vpn3000 ipsec-attributes pre-shared-key * ... policy-map global_policy class inspection_default inspect dns maximum-length 512 inspect ftp inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp inspect http inspect ils inspect pptp ! service-policy global_policy global I am able to get everywhere, just no DNS. Any help would be appreciated. Thanks This email may contain material that is confidential, privileged, and/or attorney work product for the sole use of the intended recipient. Any review, reliance, or distribution by others or forwarding without express permission is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
