topic Re: Cisco Firepower Anyconnect failuer in Network Security

Cisco Firepower Anyconnect failuer

saids3 — Fri, 10 Mar 2023 06:11:46 GMT

Anyconnect is not able to connect to the server error!!

Firewall in BVI mode -

Re: Cisco Firepower Anyconnect failuer

Karsten Iwen — Fri, 10 Mar 2023 06:38:49 GMT

Your failure description is quite vague ...

But at least you have to make sure that the NAT-exemption rule is above the general internet rule. And I would configure this in the same logic as the "normal" NAT rule: From "any" to "outside".

Re: Cisco Firepower Anyconnect failuer

saids3 — Fri, 10 Mar 2023 06:47:32 GMT

I'm sorry for the lack of information!

I'm trying to VPN my office from ouside network like a cafe or any other source wifi! I'm not able to get this right!!

Re: Cisco Firepower Anyconnect failuer

saids3 — Fri, 10 Mar 2023 12:00:23 GMT

@Karsten Iwen @Sheraz.Salim @Rob Ingram This is what happened when I shift anyconnect nat to the top -

1. I can connect through anyconnect working perfectly but the second nat will stop working (OPEN-DSM).

2. I can't ping my inside network like 10.206.167.111

Re: Cisco Firepower Anyconnect failuer

Sheraz.Salim — Thu, 16 Mar 2023 08:31:38 GMT

The nat rule of anyconnect is wrong. you need to exempt the vpn pool and the local subnet in order to reach the resource behind the Firewall. the rule you have it wont all you to connect the vpn AC behind the firewall.

your nat rule should be in this order. I am writing the ASA code as I dont have FTD so you can work it around.

nat(inside,outside) source static local-network local-network destin static vpn-pool vpn-pool no proxy arp route-lookup.