71818
25.11.2008, aktualisiert am 11.12.2008
9488
3
0
Cisco ASA 5505, VPN RA Problem mit Traffic, No translation group found
Hallo Administrator-Gemeinde,
momentan bin ich mit unserer ASA 5505 am Arbeiten und habe die Radius-Protokoll-Authentifizierung am IAS-Service unseres AD-Servers eingerichtet.
Somit können sich die User mit Ihrem Domänen-Kennwort auch via VPN einwählen, sofern sie in der entsprechenden Gruppe eingeordnet sind.
Ich stehe vor dem Problem das kein Traffic von den Eingewählten RA-Clients (Cisco SoftwareVPN-Client 5.0.x) an das interne Netz weitergeleitet wird.
Phase 1 und Phase 2 werden jedoch erfolgreich aufgebaut und ASDM meldet eine erfolgreiche Verbindung der Clients.
Die Debugging-Logs sagen z.B für einen FTP-Zugriff.
3 Nov 25 2008 11:35:21 305005 ad_server No translation group found for tcp src wan2:172.16.1.1/1216 dst inside:ad_server/21
Wo und wie stelle ich eine Translation-"Group" ein?
Unten stehen die Configuration der ASA.
ASA Version 8.0(2)
!
hostname ciscoasa
domain-name company_xyz
enable password #### encrypted
names
name 192.168.1.1 ad_server
name 192.168.1.4 terminal_server
name 192.168.1.205 vm_server
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.70 255.255.255.0
ospf cost 10
!
interface Vlan2
nameif wan2
security-level 0
pppoe client vpdn group isp2
ip address pppoe setroute
ospf cost 10
!
interface Vlan12
nameif wan1
security-level 0
pppoe client vpdn group isp1
ip address pppoe setroute
ospf cost 10
!
interface Ethernet0/0
description WAN2 Zugang zu Telekom
switchport access vlan 12
!
interface Ethernet0/1
switchport access vlan 2
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd #### encrypted
boot system disk0:/asa802-k8.bin
ftp mode passive
dns domain-lookup inside
dns domain-lookup wan2
dns server-group DefaultDNS
name-server 194.25.2.129
name-server ad_server
domain-name company_xyz
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
access-list wan1_access_in extended permit ip any any
access-list wan2_access_in extended permit ip any any
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 172.16.1.0 255.255.255.0
access-list inside_access_in extended permit ip any any
access-list split-tunnel standard permit 192.168.1.0 255.255.255.0
access-list wan2_access_out extended permit ip any any
access-list inside_access_in_1 extended deny udp host 192.168.1.20 224.0.1.0 255.255.255.0
access-list inside_access_in_1 extended permit ip any any
pager lines 24
logging enable
logging buffered debugging
logging asdm notifications
logging host inside 192.168.1.219
logging debug-trace
mtu inside 1500
mtu wan2 1492
mtu wan1 1492
ip local pool vpn_pool 172.16.1.1-172.16.1.253 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-602.bin
no asdm history enable
arp timeout 14400
nat-control
global (inside) 1 interface
global (wan2) 1 interface
nat (inside) 1 192.168.1.0 255.255.255.0 dns
static (inside,wan2) tcp interface www vm_server www netmask 255.255.255.255
static (inside,wan1) tcp interface 3389 terminal_server 3389 netmask 255.255.255.255
static (inside,wan1) tcp interface 993 ad_server 993 netmask 255.255.255.255
static (inside,wan1) tcp interface imap4 ad_server imap4 netmask 255.255.255.255
static (inside,wan1) tcp interface smtp ad_server smtp netmask 255.255.255.255
static (inside,wan1) tcp interface ftp-data ad_server ftp-data netmask 255.255.255.255
static (inside,wan1) tcp interface ftp ad_server ftp netmask 255.255.255.255
static (inside,wan1) tcp interface www ad_server www netmask 255.255.255.255
static (inside,wan1) tcp interface https ad_server https netmask 255.255.255.255
access-group inside_access_in_1 in interface inside
access-group wan2_access_in in interface wan2
access-group wan2_access_out out interface wan2
access-group wan1_access_in in interface wan1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
aaa-server ias_server protocol radius
aaa-server ias_server host ad_server
key company_xyz
radius-common-pw company_xyz
acl-netmask-convert auto-detect
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set tran1 esp-3des esp-md5-hmac
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto dynamic-map dyn1 1 set transform-set ESP-3DES-SHA
crypto dynamic-map dyn1 1 set reverse-route
crypto map wan2_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map mymap 999 ipsec-isakmp dynamic dyn1
crypto map mymap interface wan2
crypto ca trustpoint ASDM_TrustPoint0
enrollment terminal
fqdn ciscoasa
subject-name CN=pma.company_xyz.com,OU=IT,O=company_xyz GmbH,C=DE,St=he,EA=administrator@company_xyz.com
keypair cisco_vpn_key
no client-types
crl configure
crypto isakmp enable wan2
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 3600
crypto isakmp policy 10
authentication pre-share
encryption aes-256
hash md5
group 5
lifetime 86400
no crypto isakmp nat-traversal
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
management-access inside
vpdn group isp2 request dialout pppoe
vpdn group isp2 localname feste-ip5/####@t-online-com.de
vpdn group isp2 ppp authentication pap
vpdn group isp1 request dialout pppoe
vpdn group isp1 localname feste-ip4/####0@t-online-com.de
vpdn group isp1 ppp authentication pap
vpdn username feste-ip5/####@t-online-com.de password * store-local
vpdn username feste-ip4/####@t-online-com.de password * store-local
dhcpd auto_config wan2
!
dhcpd dns 195.244.245.27 interface inside
!
threat-detection basic-threat
threat-detection statistics access-list
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
group-policy company_xyz internal
group-policy company_xyz attributes
dns-server value 192.168.1.1
vpn-session-timeout 15
vpn-tunnel-protocol IPSec l2tp-ipsec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value split-tunnel
default-domain value company_xyz
tunnel-group company_xyz type remote-access
tunnel-group company_xyz general-attributes
address-pool vpn_pool
authentication-server-group ias_server
default-group-policy company_xyz
tunnel-group company_xyz ipsec-attributes
pre-shared-key *
peer-id-validate nocheck
isakmp keepalive threshold 20 retry 10
prompt hostname context
Cryptochecksum:####
: end
asdm image disk0:/asdm-602.bin
no asdm history enable
momentan bin ich mit unserer ASA 5505 am Arbeiten und habe die Radius-Protokoll-Authentifizierung am IAS-Service unseres AD-Servers eingerichtet.
Somit können sich die User mit Ihrem Domänen-Kennwort auch via VPN einwählen, sofern sie in der entsprechenden Gruppe eingeordnet sind.
Ich stehe vor dem Problem das kein Traffic von den Eingewählten RA-Clients (Cisco SoftwareVPN-Client 5.0.x) an das interne Netz weitergeleitet wird.
Phase 1 und Phase 2 werden jedoch erfolgreich aufgebaut und ASDM meldet eine erfolgreiche Verbindung der Clients.
Die Debugging-Logs sagen z.B für einen FTP-Zugriff.
3 Nov 25 2008 11:35:21 305005 ad_server No translation group found for tcp src wan2:172.16.1.1/1216 dst inside:ad_server/21
Wo und wie stelle ich eine Translation-"Group" ein?
Unten stehen die Configuration der ASA.
- Saved
ASA Version 8.0(2)
!
hostname ciscoasa
domain-name company_xyz
enable password #### encrypted
names
name 192.168.1.1 ad_server
name 192.168.1.4 terminal_server
name 192.168.1.205 vm_server
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.70 255.255.255.0
ospf cost 10
!
interface Vlan2
nameif wan2
security-level 0
pppoe client vpdn group isp2
ip address pppoe setroute
ospf cost 10
!
interface Vlan12
nameif wan1
security-level 0
pppoe client vpdn group isp1
ip address pppoe setroute
ospf cost 10
!
interface Ethernet0/0
description WAN2 Zugang zu Telekom
switchport access vlan 12
!
interface Ethernet0/1
switchport access vlan 2
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd #### encrypted
boot system disk0:/asa802-k8.bin
ftp mode passive
dns domain-lookup inside
dns domain-lookup wan2
dns server-group DefaultDNS
name-server 194.25.2.129
name-server ad_server
domain-name company_xyz
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
access-list wan1_access_in extended permit ip any any
access-list wan2_access_in extended permit ip any any
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 172.16.1.0 255.255.255.0
access-list inside_access_in extended permit ip any any
access-list split-tunnel standard permit 192.168.1.0 255.255.255.0
access-list wan2_access_out extended permit ip any any
access-list inside_access_in_1 extended deny udp host 192.168.1.20 224.0.1.0 255.255.255.0
access-list inside_access_in_1 extended permit ip any any
pager lines 24
logging enable
logging buffered debugging
logging asdm notifications
logging host inside 192.168.1.219
logging debug-trace
mtu inside 1500
mtu wan2 1492
mtu wan1 1492
ip local pool vpn_pool 172.16.1.1-172.16.1.253 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-602.bin
no asdm history enable
arp timeout 14400
nat-control
global (inside) 1 interface
global (wan2) 1 interface
nat (inside) 1 192.168.1.0 255.255.255.0 dns
static (inside,wan2) tcp interface www vm_server www netmask 255.255.255.255
static (inside,wan1) tcp interface 3389 terminal_server 3389 netmask 255.255.255.255
static (inside,wan1) tcp interface 993 ad_server 993 netmask 255.255.255.255
static (inside,wan1) tcp interface imap4 ad_server imap4 netmask 255.255.255.255
static (inside,wan1) tcp interface smtp ad_server smtp netmask 255.255.255.255
static (inside,wan1) tcp interface ftp-data ad_server ftp-data netmask 255.255.255.255
static (inside,wan1) tcp interface ftp ad_server ftp netmask 255.255.255.255
static (inside,wan1) tcp interface www ad_server www netmask 255.255.255.255
static (inside,wan1) tcp interface https ad_server https netmask 255.255.255.255
access-group inside_access_in_1 in interface inside
access-group wan2_access_in in interface wan2
access-group wan2_access_out out interface wan2
access-group wan1_access_in in interface wan1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
aaa-server ias_server protocol radius
aaa-server ias_server host ad_server
key company_xyz
radius-common-pw company_xyz
acl-netmask-convert auto-detect
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set tran1 esp-3des esp-md5-hmac
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto dynamic-map dyn1 1 set transform-set ESP-3DES-SHA
crypto dynamic-map dyn1 1 set reverse-route
crypto map wan2_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map mymap 999 ipsec-isakmp dynamic dyn1
crypto map mymap interface wan2
crypto ca trustpoint ASDM_TrustPoint0
enrollment terminal
fqdn ciscoasa
subject-name CN=pma.company_xyz.com,OU=IT,O=company_xyz GmbH,C=DE,St=he,EA=administrator@company_xyz.com
keypair cisco_vpn_key
no client-types
crl configure
crypto isakmp enable wan2
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 3600
crypto isakmp policy 10
authentication pre-share
encryption aes-256
hash md5
group 5
lifetime 86400
no crypto isakmp nat-traversal
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
management-access inside
vpdn group isp2 request dialout pppoe
vpdn group isp2 localname feste-ip5/####@t-online-com.de
vpdn group isp2 ppp authentication pap
vpdn group isp1 request dialout pppoe
vpdn group isp1 localname feste-ip4/####0@t-online-com.de
vpdn group isp1 ppp authentication pap
vpdn username feste-ip5/####@t-online-com.de password * store-local
vpdn username feste-ip4/####@t-online-com.de password * store-local
dhcpd auto_config wan2
!
dhcpd dns 195.244.245.27 interface inside
!
threat-detection basic-threat
threat-detection statistics access-list
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
group-policy company_xyz internal
group-policy company_xyz attributes
dns-server value 192.168.1.1
vpn-session-timeout 15
vpn-tunnel-protocol IPSec l2tp-ipsec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value split-tunnel
default-domain value company_xyz
tunnel-group company_xyz type remote-access
tunnel-group company_xyz general-attributes
address-pool vpn_pool
authentication-server-group ias_server
default-group-policy company_xyz
tunnel-group company_xyz ipsec-attributes
pre-shared-key *
peer-id-validate nocheck
isakmp keepalive threshold 20 retry 10
prompt hostname context
Cryptochecksum:####
: end
asdm image disk0:/asdm-602.bin
no asdm history enable
Auf Facebook teilen
Auf Twitter teilen
Auf Reddit teilen
Auf Linkedin teilenBitte markiere auch die Kommentare, die zur Lösung des Beitrags beigetragen haben
Content-ID: 102617
Url: https://administrator.de/contentid/102617
Ausgedruckt am: 22.11.2024 um 18:11 Uhr
3 Kommentare
Neuester Kommentar
Huhu,
schonmal gegoogelt? ;)
305005
"Error Message %PIX|ASA-3-305005: No translation group found for protocol src
interface_name:source_address/source_port dst interface_name:dest_address/dest_port
Explanation A packet does not match any of the outbound nat command rules. If NAT is not configured for the specified source and destination systems, this message may be generated frequently.
Recommended Action This message indicates a configuration error. If dynamic NAT is desired for the source host, ensure that the nat command matches the source IP address. If static NAT is desired for the source host, ensure that the local IP address of the static command matches. If no NAT is desired for the source host, check the ACL bound to the NAT 0 ACL. "
Hast auf jedenfall nen Dreher in deinem NAT.
Hier passende Seite von Cisco:
http://www.cisco.com/en/US/docs/security/asa/asa72/system/message/logms ...
MFG
DuckY
MCSE Messaging
MCSE Security
schonmal gegoogelt? ;)
305005
"Error Message %PIX|ASA-3-305005: No translation group found for protocol src
interface_name:source_address/source_port dst interface_name:dest_address/dest_port
Explanation A packet does not match any of the outbound nat command rules. If NAT is not configured for the specified source and destination systems, this message may be generated frequently.
Recommended Action This message indicates a configuration error. If dynamic NAT is desired for the source host, ensure that the nat command matches the source IP address. If static NAT is desired for the source host, ensure that the local IP address of the static command matches. If no NAT is desired for the source host, check the ACL bound to the NAT 0 ACL. "
Hast auf jedenfall nen Dreher in deinem NAT.
Hier passende Seite von Cisco:
http://www.cisco.com/en/US/docs/security/asa/asa72/system/message/logms ...
MFG
DuckY
MCSE Messaging
MCSE Security
Hast auf jedenfall nen Dreher in deinem NAT.
Hier passende Seite von Cisco:
http://www.cisco.com/en/US/docs/security/asa/asa72/system/message/logms ...
MFG
DuckY
MCSE Messaging
MCSE Security
Hier passende Seite von Cisco:
http://www.cisco.com/en/US/docs/security/asa/asa72/system/message/logms ...
MFG
DuckY
MCSE Messaging
MCSE Security
Hallo DuckY,
vielen Dank für Deine Antwort, ich verstehe aber leider noch nicht ganz wie die Regel lauten muß.
Prinzipiell laufen doch die VPN-Client mit der Adresse 172.16.1.0/24 an der WAN2-Schnittstelle auf.
Die Nat Regel sollte dann doch die 172.16.1.0/24 an WAN2 nach Inside (192.168.1.0/24) umschreiben, oder sehe ich das falsch?!
Wenn ich das in diesem Schema in der ASDM eingebe bekomme ich die Fehlermeldung von Überlappenden Adress-Listen, (genauer der vpn_pool)
Irgendwie macht es noch nicht ganz klick, weißt Du vielleicht ein Konfigurationsbeispiel? Ich habe es leider nicht hinbekommen.
Beste Grüße
Haferflocke
Du hast vielleicht nur eine kleine Dinge vergessen.
Du musst im jedem Fall ein NAT (NAT Ausgrenzung) Regel konfigurieren für Datenverkehr die passt durch VPN.
Mit diese Kommandos kannst du VPN traffic von NAT ausschließen:
access-list nonat extended permit ip 192.168.1.0 255.255.255.0 172.16.1.0 255.255.255.0
nat (inside) 0 access-list nonat_acl
Könntest du es probieren und rückmelden?
Akos
Du musst im jedem Fall ein NAT (NAT Ausgrenzung) Regel konfigurieren für Datenverkehr die passt durch VPN.
Mit diese Kommandos kannst du VPN traffic von NAT ausschließen:
access-list nonat extended permit ip 192.168.1.0 255.255.255.0 172.16.1.0 255.255.255.0
nat (inside) 0 access-list nonat_acl
Könntest du es probieren und rückmelden?
Akos
