topic Re: AnyConnect users cannot reach inside network and ASA? in Network Security

AnyConnect users cannot reach inside network and ASA?

samhopealpha — Tue, 12 Mar 2019 02:26:30 GMT

Here is the envirnoment

Firewall : ASA5510 9.1(2)

ASDM : 7.1

Firewall IP : 192.168.88.1

Office Inside network : 192.168.88.x

AnyConnect VPN : 172.16.89.x

Result #1:

Office user can

- access the Internet

- access to VPN User's computer

- access to ASA firewall

Result #2:

VPN user can

- access the inside network

- access the Internet

- cannot ping/access inside network's computer

- cannot ping/access the ASA firewall

Anybody could help where should I need to check?

Attached with the ASA configuration

Thanks in advance

Sam

Re: AnyConnect users cannot reach inside network and ASA?

Karsten Iwen — Fri, 16 Aug 2013 07:43:18 GMT

there is no nat-exemption for your vpn:

nat (inside,outside) source static INSIDE-88 INSIDE-88 destination static VPN-89 VPN-89 no-proxy-arp route-lookup description NAT-Exempt for VPN

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

Re: AnyConnect users cannot reach inside network and ASA?

samhopealpha — Fri, 16 Aug 2013 07:53:11 GMT

NAT added, but still the same result

Re: AnyConnect users cannot reach inside network and ASA?

Karsten Iwen — Fri, 16 Aug 2013 07:58:48 GMT

How do you test it?

For Ping you should add the ICMP-Inspection:

policy-map global_policy

class inspection_default

inspect icmp

And what is the difference between

Result #2:

VPN user can

- access the inside network

- cannot ping/access inside network's computer

And I forgot to mention that the nat-exemption has to be inserted *above* the other nat-statements:

nat 1 (inside,outside) source ...

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

Re: AnyConnect users cannot reach inside network and ASA?

samhopealpha — Fri, 16 Aug 2013 08:19:35 GMT

Thanks Karsten~ after the NAT has been moved to the above, VPN user can ping and access the inside network's computer now,

But the ASA firewall still cannot be accessed by VPN user.

For the ICMP-inspection, seems there is no big difference between turning it ON or OFF

AnyConnect users cannot reach inside network and ASA?

Jouni Forss — Fri, 16 Aug 2013 08:22:52 GMT

Hi,

For management through the VPN you should probably use the "inside" interface IP address by inserting the following command

management-access inside

Then you should be able to connect to the "inside" IP address from VPN provided that the other configurations allow it.

- Jouni

Re: AnyConnect users cannot reach inside network and ASA?

samhopealpha — Fri, 16 Aug 2013 08:27:39 GMT

Thanks everybody!! all problems resolved !