This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cant access WebAdmin while on Cisco VPN

So my new setup is pretty basic.

Internal network is 10.1.1.1/24 and the Astaro box is 10.1.1.254. I can access WebAdmin via the external interface just fine. I can also access WebAdmin via the internal interface when I'm physically connected to the internal network.

However, when I connect via Cisco VPN client to the Astaro box (VPN pool is 10.1.1.96/29) which puts me on the inside network, I get the following:

23:57:38	WebAdmin connection attempt	TCP	10.1.1.97	:	62117	→	10.1.1.254	:	4444	[SYN]	len=52	ttl=128	tos=0x00	srcmac=0:1:64[:D]b:f8:1c	dstmac=0:9:6b:7f:6b:34

23:57:43	WebAdmin connection attempt	TCP	10.1.1.97	:	62118	→	10.1.1.254	:	4444	[SYN]	len=52	ttl=128	tos=0x00	srcmac=0:1:64[:D]b:f8:1c	dstmac=0:9:6b:7f:6b:34

23:57:43	WebAdmin connection attempt	TCP	10.1.1.97	:	62119	→	10.1.1.254	:	4444	[SYN]	len=52	ttl=128	tos=0x00	srcmac=0:1:64[:D]b:f8:1c	dstmac=0:9:6b:7f:6b:34

23:57:45	WebAdmin connection attempt	TCP	10.1.1.97	:	62117	→	10.1.1.254	:	4444	[SYN]	len=48	ttl=128	tos=0x00	srcmac=0:1:64[:D]b:f8:1c	dstmac=0:9:6b:7f:6b:34

23:57:46	WebAdmin connection attempt	TCP	10.1.1.97	:	62118	→	10.1.1.254	:	4444	[SYN]	len=52	ttl=128	tos=0x00	srcmac=0:1:64[:D]b:f8:1c	dstmac=0:9:6b:7f:6b:34

23:57:46	WebAdmin connection attempt	TCP	10.1.1.97	:	62119	→	10.1.1.254	:	4444	[SYN]	len=52	ttl=128	tos=0x00	srcmac=0:1:64[:D]b:f8:1c	dstmac=0:9:6b:7f:6b:34

23:57:52	WebAdmin connection attempt	TCP	10.1.1.97	:	62118	→	10.1.1.254	:	4444	[SYN]	len=48	ttl=128	tos=0x00	srcmac=0:1:64[:D]b:f8:1c	dstmac=0:9:6b:7f:6b:34

23:57:52	WebAdmin connection attempt	TCP	10.1.1.97	:	62119	→	10.1.1.254	:	4444	[SYN]	len=48	ttl=128	tos=0x00	srcmac=0:1:64[:D]b:f8:1c	dstmac=0:9:6b:7f:6b:34

23:58:04	WebAdmin connection attempt	TCP	10.1.1.97	:	62124	→	10.1.1.254	:	4444	[SYN]	len=52	ttl=128	tos=0x00	srcmac=0:1:64[:D]b:f8:1c	dstmac=0:9:6b:7f:6b:34

23:58:07	WebAdmin connection attempt	TCP	10.1.1.97	:	62124	→	10.1.1.254	:	4444	[SYN]	len=52	ttl=128	tos=0x00	srcmac=0:1:64[:D]b:f8:1c	dstmac=0:9:6b:7f:6b:34

23:58:13	WebAdmin connection attempt	TCP	10.1.1.97	:	62124	→	10.1.1.254	:	4444	[SYN]	len=48	ttl=128	tos=0x00	srcmac=0:1:64[:D]b:f8:1c	dstmac=0:9:6b:7f:6b:34

I currently have firewall rules to allow the 10.1.1.1/24 to any but that didn't help.

Any ideas?

This thread was automatically locked due to age.

0 BAlfson over 13 years ago

You will have routing problems if you modify the VPN Pools to overlap with the internal IPs. Change the "VPN Pool (Cisco)" back to 10.242.5.0/24.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel

0 doublejz over 13 years ago in reply to BAlfson

Ok so I put the pool back to the original, jumped on VPN and still no good. The firewall logs show no allow or denies but the page doesn't load.

Out of curiosity I tried doing a traceroute to the internal Astaro NIC.

C:\Users\Owner>tracert 10.1.1.254

Tracing route to 10.1.1.254 over a maximum of 30 hops

  1  General failure.

Trace complete.

C:\Users\Owner>

C:\Users\Owner>route print 10.*

IPv4 Route Table

===========================================================================

Active Routes:

Network Destination        Netmask          Gateway       Interface  Metric

         10.0.0.0        255.0.0.0         On-link        10.242.5.1    281

         10.1.1.0    255.255.255.0         10.0.0.1       10.242.5.1    100

       10.242.5.1  255.255.255.255         On-link        10.242.5.1    281

   10.255.255.255  255.255.255.255         On-link        10.242.5.1    281

===========================================================================

Persistent Routes:

  None



IPv6 Route Table

===========================================================================

Active Routes:

  None

Persistent Routes:

  None



C:\Users\Owner>


Description . . . . . . . . . . . : Cisco Systems VPN Adapter for 64-bit Windows

Physical Address. . . . . . . . . : 00-05-9A-3C-78-00

DHCP Enabled. . . . . . . . . . . : No

Autoconfiguration Enabled . . . . : Yes

Link-local IPv6 Address . . . . . : fe80::e165:79cb[:D]85d:7b9b%20(Preferred)

IPv4 Address. . . . . . . . . . . : 10.242.5.1(Preferred)

Subnet Mask . . . . . . . . . . . : 255.0.0.0

Default Gateway . . . . . . . . . :

DHCPv6 IAID . . . . . . . . . . . : 603981210

DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-16-9D-7C-05-00-21-70-D5-1B-0C



DNS Servers . . . . . . . . . . . : 8.8.8.8

                                    8.8.4.4

NetBIOS over Tcpip. . . . . . . . : Enabled

0 BAlfson over 13 years ago

Network Destination        Netmask          Gateway       Interface  Metric

         10.0.0.0        255.0.0.0         On-link        10.242.5.1    281

         10.1.1.0    255.255.255.0         10.0.0.1       10.242.5.1    100

I would have expected an address in 10.242.5.0/24 there. What does ipconfig tell you is the IP of the DHCP server for this adapter? If this is Win7, are you sure you have the permissions right?

Cheers - Bob

0 doublejz over 13 years ago in reply to BAlfson

The above output shows

DHCP Enabled. . . . . . . . . . . : No

Also, DHCP was on for the 10.1.1.1/24 network and I turned if off but it didn't work either way. I'm guessing it's because VPN users hit the 10.252.5.0/24 network anyway.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 13 years ago

Also, it's strange that you were assigned 10.242.5.1 as the .1 address normally is the first hop (the Astaro virtual interface) on a trace route. (Note: unlike PPTP, L2TP and SSL, there is no ASG-asociated IP in a tracert passing throughthe tunnel.)

In WebAdmin 'Support >> Advanced' on the 'Routes Table' tab, what digit follows local 10.242.5.? (Note: This line does not appear for the Cisco method.)

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel

0 doublejz over 13 years ago in reply to BAlfson

I stripped the public IPs/routes but heres the rest.


local default dev lo  table 252  scope host 

10.1.1.0/24 dev eth1  proto kernel  scope link  src 10.1.1.254 

127.0.0.0/8 dev lo  scope link 

broadcast 10.1.1.0 dev eth1  table local  proto kernel  scope link  src 10.1.1.254 

local 10.1.1.254 dev eth1  table local  proto kernel  scope host  src 10.1.1.254 

broadcast 10.1.1.255 dev eth1  table local  proto kernel  scope link  src 10.1.1.254 

broadcast 127.0.0.0 dev lo  table local  proto kernel  scope link  src 127.0.0.1 

local 127.0.0.0/8 dev lo  table local  proto kernel  scope host  src 127.0.0.1 

local 127.0.0.1 dev lo  table local  proto kernel  scope host  src 127.0.0.1 

broadcast 127.255.255.255 dev lo  table local  proto kernel  scope link  src 127.0.0.1 

unreachable default dev lo  table unspec  proto kernel  metric -1  error -101 hoplimit 255

fe80::/64 dev eth0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0

fe80::/64 dev eth1  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0

unreachable default dev lo  table unspec  proto kernel  metric -1  error -101 hoplimit 255

local ::1 via :: dev lo  table local  proto none  metric 0  mtu 16436 advmss 16376 hoplimit 0

ff00::/8 dev eth0  table local  metric 256  mtu 1500 advmss 1440 hoplimit 0

ff00::/8 dev eth1  table local  metric 256  mtu 1500 advmss 1440 hoplimit 0

unreachable default dev lo  table unspec  proto kernel  metric -1  error -101 hoplimit 255

0 BAlfson over 13 years ago

There's no route for 10.242.5.0/24, so it looks like the Cisco VPN wasn't active at that time.

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel

0 doublejz over 13 years ago

ahhh, my bad. Didn't realize it dropped. I reconnected via VPN and I now have this.

local default dev lo  table 252  scope host 

10.1.1.0/24 dev eth1  proto kernel  scope link  src 10.1.1.254 

10.242.5.1 dev eth0  proto ipsec  scope link 

127.0.0.0/8 dev lo  scope link 

broadcast 10.1.1.0 dev eth1  table local  proto kernel  scope link  src 10.1.1.254 

local 10.1.1.254 dev eth1  table local  proto kernel  scope host  src 10.1.1.254 

broadcast 10.1.1.255 dev eth1  table local  proto kernel  scope link  src 10.1.1.254 

broadcast 127.0.0.0 dev lo  table local  proto kernel  scope link  src 127.0.0.1 

local 127.0.0.0/8 dev lo  table local  proto kernel  scope host  src 127.0.0.1 

local 127.0.0.1 dev lo  table local  proto kernel  scope host  src 127.0.0.1 

broadcast 127.255.255.255 dev lo  table local  proto kernel  scope link  src 127.0.0.1 

unreachable default dev lo  table unspec  proto kernel  metric -1  error -101 hoplimit 255

fe80::/64 dev eth0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0

fe80::/64 dev eth1  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 0

unreachable default dev lo  table unspec  proto kernel  metric -1  error -101 hoplimit 255

local ::1 via :: dev lo  table local  proto unspec  metric 0  mtu 16436 advmss 16376 hoplimit 0

ff00::/8 dev eth0  table local  metric 256  mtu 1500 advmss 1440 hoplimit 0

ff00::/8 dev eth1  table local  metric 256  mtu 1500 advmss 1440 hoplimit 0

unreachable default dev lo  table unspec  proto kernel  metric -1  error -101 hoplimit 255

0 BAlfson over 13 years ago

OK, that all looks like mine now when I connect from my iPhone with the Cisco client.  I hadn't looked at the routes with that before, and expected that, like the SSL and L2TP methods, there would be an actual route for the 10.242.5.0/24 subnet.  In those other methods, 10.242.x.1 is used.

I don't see any route for 10.0.0.0/8 via 10.0.0.1 though, so I wonder where your PC got that - did you make a persistent route at the DOS command prompt?  You might need to delete that route and then restart the Cisco client.

Also, are you sure that you have the pings and traceroute enabled on the 'ICMP' tab of 'Firewall'?  In 'Management >> WebAdmin Settings', do you have "VPN Pool (Cisco)" in 'Allowed networks'?

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel

0 doublejz over 13 years ago in reply to BAlfson

nope, there are no 10.0.0.0/8 defined anywhere that I know of. If you look in my route output you can all see there are no Persistent Routes.

Off VPN


C:\Users\Owner>route print 10.*

IPv4 Route Table

===========================================================================

Active Routes:

  None

Persistent Routes:

  None



IPv6 Route Table

===========================================================================

Active Routes:

  None

Persistent Routes:

  None

C:\Users\Owner>

On VPN


C:\Users\Owner>route print 10.*

IPv4 Route Table

===========================================================================

Active Routes:

Network Destination        Netmask          Gateway       Interface  Metric

         10.0.0.0        255.0.0.0         On-link        10.242.5.1    276

         10.1.1.0    255.255.255.0         10.0.0.1       10.242.5.1    100

       10.242.5.1  255.255.255.255         On-link        10.242.5.1    276

   10.255.255.255  255.255.255.255         On-link        10.242.5.1    276

===========================================================================

Persistent Routes:

  None



IPv6 Route Table

===========================================================================

Active Routes:

  None

Persistent Routes:

  None



C:\Users\Owner>


C:\Users\Owner>tracert 10.1.1.254

Tracing route to 10.1.1.254 over a maximum of 30 hops

  1  General failure.

Trace complete.

C:\Users\Owner>ping 10.1.1.254

Pinging 10.1.1.254 with 32 bytes of data:

General failure.

General failure.

General failure.

General failure.

Ping statistics for 10.1.1.254:

    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\Users\Owner>

But yet when I try to access https://10.1.1.254:4444 there are not firewall logs (I have every rule set to log).