# Cisco ASA Remote Access VPN
**URL:** https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830
**Category:** Lessons Discussion
**Created:** [December 19, 2016, 4:40pm UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830 "2016-12-19T16:40:34Z")
**Posts on this page:** 20
**Page:** 2
### Author:  [@Zaman.rubd](https://forum.networklessons.com/u/Zaman.rubd)
#### Post date: [April 8, 2016, 5:28pm UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/21 "2016-04-08T17:28:33Z")
Thanks Dear.Many Thanks
---
### Author:  [@amit.aps2007](https://forum.networklessons.com/u/amit.aps2007)
#### Post date: [April 18, 2016, 3:09am UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/22 "2016-04-18T03:09:09Z")
Can we create a group policy only for a specific set of users? For example, if we want that a certain group of users should only access certain set of servers.
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [April 18, 2016, 3:58pm UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/23 "2016-04-18T15:58:44Z")
Hi Amit,
Yes you can, you’ll need to create an additional policy group and tunnel group for this. Here’s a quick example:
```auto
group-policy VIRL_VPN internal
group-policy VIRL_VPN attributes
vpn-filter value VIRL
split-tunnel-policy tunnelspecified
split-tunnel-network-list value VIRL_SPLIT_TUNNEL
access-list VIRL_SPLIT_TUNNEL standard permit 192.168.1.0 255.255.255.0
access-list VIRL extended permit tcp any object VIRL object-group VIRL_PORTS
access-list VIRL extended permit tcp any object VIRL2 object-group VIRL_PORTS
tunnel-group VIRL_TUNNEL type remote-access
tunnel-group VIRL_TUNNEL general-attributes
address-pool VIRL_VPN_USERS
default-group-policy VIRL_VPN
tunnel-group VIRL_TUNNEL ipsec-attributes
ikev1 pre-shared-key *****
```
The group policy called “VIRL\_VPN” uses an access-list called VIRL to define what resources the remote user can access. It also uses split tunneling, this VPN is only used to reach the networks in access-list VIRL\_SPLIT\_TUNNEL.
In the tunnel-group, you can see we refer to the VIRL\_VPN group-policy.
Hope this helps!
Rene
---
### Author:  [@jawaraccna](https://forum.networklessons.com/u/jawaraccna)
#### Post date: [May 4, 2016, 4:07pm UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/24 "2016-05-04T16:07:42Z")
I have added the below command but am able to connect successfully but I cant access LAN device either through ping, tracert, telnet, ssh etc.
```auto
ASA1(config)# object network LAN
ASA1(config-network-object)# subnet 192.168.1.0 255.255.255.0
ASA1(config)# object network VPN_POOL
ASA1(config-network-object)# subnet 192.168.10.0 255.255.255.0
```
I wasn’t able to configure the below command since am running an 8.2 version. What am I missing?
`ASA1(config)# nat (INSIDE,OUTSIDE) source static LAN LAN destination static VPN_POOL VPN_POOL`
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [May 5, 2016, 1:54pm UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/25 "2016-05-05T13:54:50Z")
Hi Muhammed,
That NAT rule is an important one. It tells the ASA not to translate traffic between 192.168.1.0 and 192.168.10.0. If you don’t have it then traffic from 192.168.1.0 to 192.168.10.0 will be translated which is probably why you don’t have any connectivity.
For ASA versions before 8.3, you can try this:
```auto
ASA1(config)# access-list NO_NAT extended permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0
ASA1(config)# nat (inside) 0 access-list NONAT
```
ASA 8.2 has been EOL since April 2014 so it’s not a bad idea to upgrade 🙂
Rene
---
### Author:  [@ekbrooks](https://forum.networklessons.com/u/ekbrooks)
#### Post date: [September 16, 2016, 6:04am UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/26 "2016-09-16T06:04:11Z")
Rene,
IPsec Tunnel always speak of New IP Header being applied to the original header when an example is given. Can you give a real world example that shows the newly created Ip addresses in the header and the original ip addresses? I am trying to see how packets are routed from the client with a remote vpn client installed.
Thanks
---
### Author:  [@maher1](https://forum.networklessons.com/u/maher1)
#### Post date: [October 7, 2016, 4:32pm UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/27 "2016-10-07T16:32:35Z")
Hi Edwin,
For such request, you can post your idea in the following URL “[Member Ideas](https://networklessons.com/lesson-ideas)” on our website where your idea can be voted so Rene can pick it up and make a new lesson from it.
Thanks for following our lessons.
---
### Author:  [@gurrav](https://forum.networklessons.com/u/gurrav)
#### Post date: [November 15, 2016, 4:49pm UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/28 "2016-11-15T16:49:29Z")
Hi,
I need to create to remote access VPN but my outside interface have private adddress with ISP conecction.
My DMZ have public address.
Can do I make to VPN remote access in my ASA 5520 with NAT to one public address ??
best regars
---
### Author:  [@gurrav](https://forum.networklessons.com/u/gurrav)
#### Post date: [November 15, 2016, 8:36pm UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/29 "2016-11-15T20:36:45Z")
Hi Rene,
Can do I make a VPN if my outside interface have private address IP, but I have public IP address for my DMZ interface ?
---
### Author:  [@gurrav](https://forum.networklessons.com/u/gurrav)
#### Post date: [November 16, 2016, 4:52pm UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/30 "2016-11-16T16:52:54Z")
Hi Rene,
I have private ip address in the outside interface connected the ISP, and DMZ interface have public IP for diferent service. then the question is:
Can do I use a IP public address from my pool of DMZ for get up my VPN remote access?
how do I make this ?
best regards
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [November 22, 2016, 8:03pm UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/31 "2016-11-22T20:03:52Z")
Hi Gabriel,
It is possible. Most devices, including the ASA firewall, support NAT traversal for IPsec.
Is your public IP addresses NATed 1-to-1 to the private IP address that your ASA uses? If so, give it a shot.
Rene
---
### Author:  [@shantel](https://forum.networklessons.com/u/shantel)
#### Post date: [December 27, 2016, 5:10pm UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/32 "2016-12-27T17:10:54Z")
19 posts were merged into an existing topic: [Cisco ASA Remote Access VPN](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830)
---
### Author:  [@sclarke1210](https://forum.networklessons.com/u/sclarke1210)
#### Post date: [March 21, 2017, 3:19pm UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/33 "2017-03-21T15:19:16Z")
HI
When the tunnel is brought up on the ASA does it create a logical tunnel interface and assign it an ip address from the vpn pool?
what show commands could i use to see this interface on the asa ?
Thanks
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [April 7, 2017, 10:34am UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/34 "2017-04-07T10:34:34Z")
Hi @sclarke1210,
You won’t see a tunnel interface directly. If you want to verify that a user has connected and see the IP address that was assigned from the VPN pool, it’s best to use these two commands:
```
ASA# show crypto ikev1 sa
IKEv1 SAs:
Active SA: 1
Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1
2 IKE Peer: 62.44.197.140
Type : user Role : responder
Rekey : no State : AM_ACTIVE
```
Above you can see that a user has connected. The IP addresses you can see below:
```
ASA# show crypto ipsec sa user renemolenaar
username: renemolenaar
Crypto map tag: RMCS_VPN, seq num: 10, local addr: 1.2.3.4
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (192.168.1.100/255.255.255.255/0/0)
current_peer: 62.44.197.140, username: renemolenaar
dynamic allocated peer ip: 192.168.1.100
dynamic allocated peer ip(ipv6): 0.0.0.0
#pkts encaps: 67, #pkts encrypt: 67, #pkts digest: 67
#pkts decaps: 75, #pkts decrypt: 75, #pkts verify: 75
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 67, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 1.2.3.4/4500, remote crypto endpt.: 62.44.197.140/6967
path mtu 1500, ipsec overhead 82(52), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: 029C51AC
current inbound spi : 323F5F7F
inbound esp sas:
spi: 0x323F5F7F (843014015)
transform: esp-aes esp-sha-hmac no compression
in use settings ={RA, Tunnel, NAT-T-Encaps, IKEv1, }
slot: 0, conn_id: 4460544, crypto-map: RMCS_VPN
sa timing: remaining key lifetime (sec): 28722
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
spi: 0x029C51AC (43798956)
transform: esp-aes esp-sha-hmac no compression
in use settings ={RA, Tunnel, NAT-T-Encaps, IKEv1, }
slot: 0, conn_id: 4460544, crypto-map: RMCS_VPN
sa timing: remaining key lifetime (sec): 28722
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
```
Above you can see the **dynamic allocated peer ip** , which is the IP address from the VPN pool.
Rene
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [August 18, 2017, 11:05am UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/35 "2017-08-18T11:05:05Z")
A post was merged into an existing topic: [Cisco ASA Anyconnect Remote Access VPN](https://forum.networklessons.com/t/cisco-asa-anyconnect-remote-access-vpn/833)
---
### Author:  [@zeeshan\_yousuf](https://forum.networklessons.com/u/zeeshan_yousuf)
#### Post date: [April 3, 2020, 5:42pm UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/36 "2020-04-03T17:42:14Z")
Hi Rene,
Hope you are doing well and safe.
Did you make any guide with IKEv2 with VPN client (NOT Anyconnect)
Please let me know
Thanks
Regards
Zeeshan
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [April 5, 2020, 3:06pm UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/37 "2020-04-05T15:06:44Z")
Hello Zeeshan
There is no lesson that specifically includes the use of IKEv2 with VPN hosts as clients without using Anyconnect. The specific configuration would depend on the specific VPN client that you are using on the host end. You can find some examples of IKEv2 VPNs with use with Windows or Android VPN clients on a Cisco ASA device at the following links:
> **[ASA IKEv2 RA VPN With Windows 7 or Android VPN Clients and Certificate...](https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/213246-asa-ikev2-ra-vpn-with-windows-7-or-andro.html)**
>
> This document describes how to configure ASA in order to allow Windows 7 and Android native RA VPN clients
For more specific VPN client configurations, it is best to use your favourite search engine to find configs for your particular clients.
I hope this has been helpful!
Laz
---
### Author:  [@alberto.amante.diaz](https://forum.networklessons.com/u/alberto.amante.diaz)
#### Post date: [April 8, 2020, 5:06pm UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/38 "2020-04-08T17:06:07Z")
Hi Rene,
Why does it set twice in the next statement the words LAN LAN and VPN\_POOL VPN\_POOL?
`ASA1(config)# nat (INSIDE,OUTSIDE) source static **LAN LAN** destination static **VPN_POOL VPN_POOL** `
---
### Author:  [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [April 9, 2020, 6:42am UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/39 "2020-04-09T06:42:30Z")
Hello Alberto
This is actually correct. This is what is called “Twice NAT” or “Identity NAT”. Take a look at the image of the network:
The ASA has NATing enabled, so any traffic going from INSIDE to OUTSIDE, or visa versa, will be NATed.
The VPN client on the OUTSIDE network is on the 10.10.10.0/24 subnet. When it connects via VPN, its connection is tunneled over this subnet, and the internal IP address it is provided is in the 192.168.10.0/24 subnet, which is configured in the VPN\_POOL.
So the client sends encapsulated data to R1 over the tunnel. Outside IP header 10.10.10.0/24 subnet, inside IP header 192.168.10.0/24 subnet. Once it reaches the ASA outside interface, it is first decapsulated, so the 10.10.10.0/24 IP address is removed.
The result is an IP packet **with a source and destination IP in the 192.168.10.0/24 subnet** , and the packet is going in the OUTSIDE interface and exiting the INSIDE interface. Under normal circumstances, **this traffic would be NATed**. But we don’t want that, because the addresses are already the inside addresses we want. So we use this commands:
```
ASA1(config)# object network LAN
ASA1(config-network-object)# subnet 192.168.1.0 255.255.255.0
ASA1(config)# object network VPN_POOL
ASA1(config-network-object)# subnet 192.168.10.0 255.255.255.0
ASA1(config)# nat (INSIDE,OUTSIDE) source static LAN LAN destination static VPN_POOL VPN_POOL
```
These commands simply state that any traffic that traverses the ASA with these IP addresses should not be translated. It essentially says: translate 192.168.1.0/24 to 192.168.1.0/24 and 192.168.10.0/24 to 192.168.10.0/24. This is why LAN and VPN\_POOL are stated twice in the comand.
I hope this has been helpful!
Laz
---
### Author:  [@sims](https://forum.networklessons.com/u/sims)
#### Post date: [May 21, 2020, 12:28am UTC](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830/40 "2020-05-21T00:28:13Z")
Hi,
I can connect the vpn , but I can’t reach the any of the network .
What could be the issue .How to trouble shoot
Thanks
[Previous page](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830.md?page=1)
[Next page](https://forum.networklessons.com/t/cisco-asa-remote-access-vpn/830.md?page=3)