Hi William, On Mon, 2008-03-31 at 14:24 +0100, William wrote: > Hi List, > > With the help of Kaj I was able to resolve the authentication issue. > > I'm now having an access-list issue I think... > > It seems the user can connect from behind their 800 router to our > network but we cannot make a connection back to them, the behavior is > like when you have EasyVPN on 'client mode'. > > For example when we try to ping we get: > > %ASA-3-106014: Deny inbound icmp src inside:11.11.11.1 dst > inside:22.22.22.2 (type 8, code 0)
Do you have the "icmp permit <net> <type> <interface>" commands in your configuration? > There was no access-list applied to the inside, so I did the following > for testing: > > access-list inside_access_in extended permit ip any any > > then > > access-group inside_access_in in interface inside > > The access-list is getting hit but I'm still getting denys in the logs. > > I can't see what else could be stopping the packets? You have to allow ICMP separately, an ACL entry is not enough I'm afraid. A little un-intuitive, but that's Cisco. :-) Regards, Peter _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
