问题现象：今天配置一台ASA9.x的anyconnect vpn，基本是直接拷贝的另外一台ASA的配置，但是这台anyconnect完全无法连接。客户端直接提示连接失败。
自己尝试排查：
1、反复检查配置，没有发现有啥不对的。
2、尝试ping ASA的outside地址，是通的。再尝试telnet X.X.X.226:9876也是可以的（X.X.X.226是outside公网地址，webvpn的port设置为9876），说明应该是ip和端口应该是通的。
3、debug webvpn anyconnect 255 没有任何信息打印
4、直接在火狐浏览器输入网址：https://X.X.X.226:9876 （其中X.X.X.226是outside公网地址，webvpn的port设置为9876），也无法访问。提示如下
自此就没有排查思路了，头都大了。请大神帮忙指导一下，下一步如何排查呢？
--------------------------------如下是配置，基本是完全按照论坛@arvinjing的配置来做的----------------------------------------------------------------------
1. 配置自签名证书
ciscoasa(config)#crypto key generate rsa label anyconnect_keypair modulus 1024
ciscoasa(config)#crypto ca trustpoint self_certificate
ciscoasa(config-ca-trustpoint)#enrollment self
ciscoasa(config-ca-trustpoint)#keypair anyconnect_keypair
ciscoasa(config-ca-trustpoint)#fqdn anyconnect.cisco.com
ciscoasa(config-ca-trustpoint)#subject-name CN=anyconnect.cisco.com
ciscoasa(config-ca-trustpoint)#crypto ca enroll self_certificate noconfirm
ciscoasa(config)#ssl trust-point self_certificate outside
2. 加载anyconnect vpn 镜像，端口改为9876
ciscoasa(config)#webvpn
ciscoasa(config-webvpn)# anyconnect image flash:/anyconnect-win-4.0.00061-k9.pkg 1
ciscoasa(config-webvpn)#port 9876
ciscoasa(config-webvpn)#anyconnect enable
ciscoasa(config-webvpn)#enable outside
3. 配置地址池
ciscoasa(config)#ip local pool anyconnect_clients 10.10.13.1-10.10.13.254 mask 255.255.255.0
4 ．配置隧道分割列表及访问控制列表旁路
ciscoasa(config)#access-list tunnel_split extended permit ip 192.168.13.0 255.255.255.0 any // (192.168.13.x为内网ip地址)
ciscoasa(config)#sysopt connection permit-vpn
5. NAT豁免
object network inside ##内网网段
subnet 192.168.13.0 255.255.255.0
object network anyconnect ##VPN地址池网段
subnet 10.10.13.0 255.255.255.0
access-list tunnel_split extended permit ip object inside any
nat (inside,outside) source static any any destination static anyconnect anyconnect no-proxy-arp route-lookup //NAT豁免
nat (inside,outside) source static anyconnect anyconnect destination static inside inside no-proxy-arp route-lookup
nat (inside,outside) after-auto source dynamic inside interface
6. 配置Group-policy调用地址池和隧道分割列表
ciscoasa(config)#group-policy anyconnect_policy internal
ciscoasa(config)#group-policy anyconnect_policy attributes
ciscoasa(config-group-policy)#address-pools value anyconnect_clients
ciscoasa(config-group-policy)#vpn-tunnel-protocol ssl-client
ciscoasa(config-group-policy)#split-tunnel-policy tunnelspecified
ciscoasa(config-group-policy)#split-tunnel-network-list value tunnel_split
7. 配置Tunnel-group
ciscoasa(config)#tunnel-group anyconnect-profile type remote-access
ciscoasa(config)#tunnel-group anyconnect-profile general-attributes
ciscoasa(config-tunnel-general)#default-group-policy anyconnect_policy
ciscoasa(config-tunnel-general)#exit
ciscoasa(config)#tunnel-group anyconnect-profile webvpn-attributes
ciscoasa(config-tunnel-webvpn)#group-alias anyconnect
ciscoasa(config-tunnel-webvpn)#exit
ciscoasa(config)#webvpn
ciscoasa(config-webvpn)#tunnel-group-list enable
8. 使用本地用户名及密码并调用Group-policy
ciscoasa(config)# username cisco pass cisco
ciscoasa(config)#username cisco attributes
ciscoasa(config-username)#vpn-group-policy anyconnect_policy
ciscoasa(config-username)#service-type remote-access
自己尝试排查：
1、反复检查配置，没有发现有啥不对的。
2、尝试ping ASA的outside地址，是通的。再尝试telnet X.X.X.226:9876也是可以的（X.X.X.226是outside公网地址，webvpn的port设置为9876），说明应该是ip和端口应该是通的。
3、debug webvpn anyconnect 255 没有任何信息打印
4、直接在火狐浏览器输入网址：https://X.X.X.226:9876 （其中X.X.X.226是outside公网地址，webvpn的port设置为9876），也无法访问。提示如下
自此就没有排查思路了，头都大了。请大神帮忙指导一下，下一步如何排查呢？
--------------------------------如下是配置，基本是完全按照论坛@arvinjing的配置来做的----------------------------------------------------------------------
1. 配置自签名证书
ciscoasa(config)#crypto key generate rsa label anyconnect_keypair modulus 1024
ciscoasa(config)#crypto ca trustpoint self_certificate
ciscoasa(config-ca-trustpoint)#enrollment self
ciscoasa(config-ca-trustpoint)#keypair anyconnect_keypair
ciscoasa(config-ca-trustpoint)#fqdn anyconnect.cisco.com
ciscoasa(config-ca-trustpoint)#subject-name CN=anyconnect.cisco.com
ciscoasa(config-ca-trustpoint)#crypto ca enroll self_certificate noconfirm
ciscoasa(config)#ssl trust-point self_certificate outside
2. 加载anyconnect vpn 镜像，端口改为9876
ciscoasa(config)#webvpn
ciscoasa(config-webvpn)# anyconnect image flash:/anyconnect-win-4.0.00061-k9.pkg 1
ciscoasa(config-webvpn)#port 9876
ciscoasa(config-webvpn)#anyconnect enable
ciscoasa(config-webvpn)#enable outside
3. 配置地址池
ciscoasa(config)#ip local pool anyconnect_clients 10.10.13.1-10.10.13.254 mask 255.255.255.0
4 ．配置隧道分割列表及访问控制列表旁路
ciscoasa(config)#access-list tunnel_split extended permit ip 192.168.13.0 255.255.255.0 any // (192.168.13.x为内网ip地址)
ciscoasa(config)#sysopt connection permit-vpn
5. NAT豁免
object network inside ##内网网段
subnet 192.168.13.0 255.255.255.0
object network anyconnect ##VPN地址池网段
subnet 10.10.13.0 255.255.255.0
access-list tunnel_split extended permit ip object inside any
nat (inside,outside) source static any any destination static anyconnect anyconnect no-proxy-arp route-lookup //NAT豁免
nat (inside,outside) source static anyconnect anyconnect destination static inside inside no-proxy-arp route-lookup
nat (inside,outside) after-auto source dynamic inside interface
6. 配置Group-policy调用地址池和隧道分割列表
ciscoasa(config)#group-policy anyconnect_policy internal
ciscoasa(config)#group-policy anyconnect_policy attributes
ciscoasa(config-group-policy)#address-pools value anyconnect_clients
ciscoasa(config-group-policy)#vpn-tunnel-protocol ssl-client
ciscoasa(config-group-policy)#split-tunnel-policy tunnelspecified
ciscoasa(config-group-policy)#split-tunnel-network-list value tunnel_split
7. 配置Tunnel-group
ciscoasa(config)#tunnel-group anyconnect-profile type remote-access
ciscoasa(config)#tunnel-group anyconnect-profile general-attributes
ciscoasa(config-tunnel-general)#default-group-policy anyconnect_policy
ciscoasa(config-tunnel-general)#exit
ciscoasa(config)#tunnel-group anyconnect-profile webvpn-attributes
ciscoasa(config-tunnel-webvpn)#group-alias anyconnect
ciscoasa(config-tunnel-webvpn)#exit
ciscoasa(config)#webvpn
ciscoasa(config-webvpn)#tunnel-group-list enable
8. 使用本地用户名及密码并调用Group-policy
ciscoasa(config)# username cisco pass cisco
ciscoasa(config)#username cisco attributes
ciscoasa(config-username)#vpn-group-policy anyconnect_policy
ciscoasa(config-username)#service-type remote-access
