This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cannot connect to internet after connecting to SSL VPN

I have ASG 7.503. I have setup SSL VPN to my home network. After I connect to the SSL VPN from my laptop, I can see my home network fine but all internet connectivity is lost. I have read all forum topics on this issue and have tried lot of settings but nothing works. The name resolution of any website fails.

Am I doing something wrong or is internet not supposed to work after connecting to SSL VPN?

Thanks...
Arun

This thread was automatically locked due to age.

0 BarryG over 15 years ago

Hi, do you have Masquerading setup for your VPN pool, and PacketFilter rules?

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 ArunGupta_01 over 15 years ago in reply to BarryG

Barry,
I have created a masquerading rule as follows:

Network: VPN Pool(SSL)
Interface: External(WAN)
Use address: >

Is this correct? What packet filter rules do I need to create?

Thanks...
Arun
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 15 years ago

That's right.

You can start with a packetfilter like:
source: SSL VPN Pool
Service: ANY
Dest: ANY
Allow

and then narrow it down from there, if needed.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 ArunGupta_01 over 15 years ago

Thanks for your reply.

I created the rule but still no luck. I turned on logging in the rule and watched live log but all I saw was dropped packets, no successful ones. Turning on/off the packet filter rules have no impact.
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 15 years ago

Do you have any DROP rules before this one?

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 ArunGupta_01 over 15 years ago in reply to BarryG

Thanks for helping me with this one.

There are no DROP rules, at least nothing that I created. I have all ALLOW rules for various other stuff.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 15 years ago

Are you using the HTTP/S Proxy? What mode? Are you seeing anything in the 'Content Filter (HTTPS)' log? Is "VPN Pool (SSL)" in 'Allowed networks' in HTTP/S?

Cheers - Bob
Cancel
Vote Up 0 Vote Down

Cancel
0 ArunGupta_01 over 15 years ago

I am using only HTTP proxy. The "Scan HTTPS (SSL) Traffic" is unchecked.. The VPN Pool (SSL) and Internet(network) is in allowed networks. The HTTP Access live log does not show any error. These are some anti-virus update attempts:

2010:02:28-16:57:48 myfirewall httpproxy[20025]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="10.242.2.6" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="1" time="157 ms" request="0xb179e280" url="liveupdate.symantecliveupdate.com/.../plain"
2010:02:28-16:57:49 myfirewall httpproxy[20025]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="GET" srcip="10.242.2.6" user="" statuscode="200" cached="0" profile="REF_DefaultHTTPProfile (Default Proxy)" filteraction="REF_DefaultHTTPCFFAction (Default content filter action)" size="8941" time="162 ms" request="0xb179e280" url="liveupdate.symantecliveupdate.com/.../zip"

I also noticed another anomaly. The nslookup resolves any site to IP but tracert does not.

C:\>nslookup www.astaro.org
Server:  cns.summitpark.pa.pitt.comcast.net
Address:  68.87.75.198

Non-authoritative answer:
Name:    astaro.org
Address:  85.115.22.9
Aliases:  www.astaro.org

C:\>tracert www.astaro.org
Unable to resolve target system name www.astaro.org.

Thanks for all your help.

Arun
Cancel
Vote Up 0 Vote Down

Cancel
0 BarryG over 15 years ago

hmm... Do you have the VPN pool allowed to use the DNS proxy?

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 ArunGupta_01 over 15 years ago

I added VPN Pool (SSL) to Network Services->DNS->Global->Allowed Networks, but internet access still fails. The name resolution is still failing for some reason. It is as if no DNS server is present on the VPN.
Cancel
Vote Up 0 Vote Down

Cancel