Cant use windows remote assistance to VPN clients

You might try to enable "Preserve Source Port Strict" in the Network Access configuration. This is just a guess and I'm not sure that it will fix your issue.

If this doesn't work then I would suggest taking a tcpdump on the bigip to see if you can find out where it is failing. Please report back with any additional information.

Seth

check on which VLAN you have the connectivity profile corresponding to this NA resource assigned to.

Alex

i have a similar problem. servers need to connect out to clients across F5 Edge. The clients are able to connect to servers just fine, but if the server tries to initiate a connection it does not make it.

i can't even connect from the F5 itself to the client (ping or telnet to a listening port). I did the 'reserve strict port' above. nope.

then i created a virtual server to route to that pool subnet. nope.

yes, these pool IP's are routed and there is no SNAT.. so the client IP is what arrives on the servers, etc.

i have a case open. to me it should just work. something must be missing.

Is it any different if you split tunnel or not? At one point I could route back if all traffic was in the tunnel but did not when split.. but then I got that to work too..

Things that seemed to have solved it: 1. No SNAT - Source Address Translation set to None on virtual server. 2. Preserve Source Port Strict set to ALL on the network stttings of the access profile (advanced). 2. Network must route the VPN pool subnet traffic back to the F5.

At one time I had also put the VPN pool subnet in the tunnel address space, but then I found it wasn't needed. It is probably implied.

I also found clients weren't resolving DNS. Well the DNS servers were internal IP's so those IP's also have to be in the split tunnel IP list in order for the queries to be routed through the VPN. Alternative would be to have the VPN use an external/public DNS/NS.

We are also using DTLS and it works well-- this is a VoIP application.

Think that was all, but it was a struggle to get it going.

Update: I did a:

tcpdump -i internal host NAclientip

And I can see the icmp echo requests hitting the Inside Vlan of the BigIP so routing is definitely working in my network.

do you have a virtual server to route back to the client? I missed that as I always have created these for resources behind the Big-IP...

it is a IP forwarding virtual server service all ports all protocols.... in this example my IP pool is 10.255.128.0/24

ltm virtual /Common/vocera_toclientIP {
    destination /Common/10.255.128.0:0
    ip-forward
    mask 255.255.255.0
    profiles {
        /Common/fastL4 { }
    }
    source 0.0.0.0/0
    translate-address disabled
    translate-port disabled
    vlans {
        /Common/vocera_cp_custom
    }
    vlans-enabled
}

Hi

I have the same problem. Had to make a foward IP VS to be able to ping the clients, so that works now, but I can not do RDP etc. to the clients.

I've made my virtual server as per above... however do I need a route table entry on the Big-IP for it to forward to? It seems to forward the traffic now but doesn't have a route to the Network Access clients. I've tried a combination of routes however as the Network Access doesn't have it's own interface no matter where I point it, it doesn't seem to work.

With the help of our lokal F5 Engineer we figured out the problem we had. As we where using routing domains, I had forgoten to add the VPN client IP adr. to the routing domain. After that was done we where able to do connect to the clients with RDP.