Cisco ASA 5510 VPN Dropping RDP Sessions

ciscocisco-asavpn

We have a Cisco ASA 5510 (47-7523-01 Rev A0) that we are using so that users can connect to the VPN from home.

I use this connection myself to do late night backups on our old database systems that don't quiesce.

It worked fine until this week, but now it seems everyone is getting kicked off at once, probably about 12 people on at the same time.

I'm told by my fellow IT guy who's been here six months longer than me that the VPN connection is 10MB down and 10MB up.

I also recorded some logs when I was having trouble staying connected myself, and I took notes that corresponded to the log number and what was happening. I don't know enough about VPNs to see if they are safe to post or not.

That said I have found a couple of articles on your site about how to configure and setup a VPN with an ASA, and I'm going to take a look at them.

I read somewhere else that the connection speed might be the problem, but I don't know it for a fact…

Best Answer

We found out that it was expecting a DNS server that wasn't there. So the DNS was set to one of Google's DNS servers, and that fixed the problem.

Related Solutions

Cisco ASA (Client VPN) to LAN – through second VPN to second LAN

Surely, you can achieve this scenario. It is called "Hairpinning" . you need the following : - configure the remote-access users POOL to be part of the crypto access-list associated with crypto map - configure NAT-EXEMPT or NO-NAT access-list to include the pool.

most importantly:

configure this command: "same-security-traffic permit intra-interface" to permit traffic to come in and go out the same interface in Cisco ASA.
configure the tunnel peer (router) to include the remote-access users pool in the crypto access-list, because the L2L tunnel crypto access-list must be mirrored in both peers.
if remote access users use split-tunneling, then you need to ensure that the subnets behind the remote peer (router) are included in the split-tunnel access-list

see this: https://supportforums.cisco.com/message/3864922

Hope This Helps.

Mashal

Cisco ASA 5510 Time of Day Based Policing

The PIXOS feature you are looking for is called Time Based Access List. It is a two step approach

Create the time-range object
Attach the time-range object to a specific rule

The ASA will then only apply the targeted rule during that time-range. You should be able to get what you want with something like this

hostname(config)#time-range OffHours
hostname(config-time-range)#periodic weekdays 17:00 to 07:00
hostname(config)#access-list Residence line 1 extended permit ip any any time-range OffHours
hostname(config)#access-group Residence in interface inside

Full write-up at Cisco Command Reference

Best Answer

Related Solutions

Cisco ASA (Client VPN) to LAN – through second VPN to second LAN

Cisco ASA 5510 Time of Day Based Policing

Related Topic