Annyconnect SSL VPN - Unable to reach external network

[jomoca1990]

Hello guys

I'm doing a lab to lear about SSL VPN session. I followed the lab and the annyconnect client was able to connect successfully. However, I do not see the network from the external router and I'm unable to reach it. Not sure what might be missing. I hope you can help me out. 

External Router 

R4

interface Loopback0
ip address 10.4.4.4 255.255.255.255
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
ip address 136.1.47.4 255.255.255.0
duplex auto
speed auto
!
interface GigabitEthernet0/2
no ip address
shutdown
duplex auto
speed auto

!
!
router eigrp 50
network 10.4.4.0 0.0.0.255
network 136.1.47.0 0.0.0.255

ASA

HI-NO-KUNI(config)# SHOW RUN CRYpto
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint SSL_TrustPoint0
enrollment self
subject-name CN=HI-NO-KUNI
keypair SSL_RSA_KEYS
crl configure
crypto ca trustpool policy
crypto ca certificate chain SSL_TrustPoint0
certificate 6b98045d
308202dc 308201c4 a0030201 0202046b 98045d30 0d06092a 864886f7 0d010105
05003030 31133011 06035504 03130a48 492d4e4f 2d4b554e 49311930 1706092a
864886f7 0d010902 160a4849 2d4e4f2d 4b554e49 301e170d 31393036 31353136
34363533 5a170d32 39303631 32313634 3635335a 30303113 30110603 55040313
0a48492d 4e4f2d4b 554e4931 19301706 092a8648 86f70d01 0902160a 48492d4e
4f2d4b55 4e493082 0122300d 06092a86 4886f70d 01010105 00038201 0f003082
010a0282 010100b5 2c12348a 6aee0062 c8ae96fd fe6ef5d3 32009f8c 2f5e75bd
e0a70f19 c4a7e949 cb986894 8a713ba5 f34fa0ed b371dfbc db8acd1f adde7c07
bd34c1cb 1757ccdb 9233b289 8d684178 f829137a 13c8ccf2 194150dc 4ab100d1
6c70af74 0962aaca ae23c0a3 975c1bd9 b36b9365 94a8321f e4fd05bf a4bfb950
25e01436 ce269968 815c29d6 269b25ef adaa6b4c d650ae8b a0b162ae 14f55785
0100a011 ea272bba dd562c4b c4b47635 8a0a935e 66c5bb31 1b7d823b 344e0984
3f003b8f fa4700eb c13db21d a93a27c3 41f8255e 770bcda3 7e1b1cd8 97c4cc99
ab1d2288 73fbb4fc 006feef3 8313f8d9 80ed726b e25ba5a2 11a81132 a0eda5a5
cc809c17 47db6d02 03010001 300d0609 2a864886 f70d0101 05050003 82010100
69f5a3b8 1b9d3923 32983154 09f1f203 a7417fa1 08ae3608 54dfa4d5 ff735ae6
875c5458 a475edd5 3d55d27f a4b56bdd c5641430 a29f485c 43732bcb ef0abf96
3eeedee8 5046a4d0 76645335 a53bb67f df2235b0 9ae430d9 92071375 5c8b79d6
8500befe 5464c508 789a0805 60d28fae b763ac72 8feff924 f6611741 6942b16c
de684301 f2e4dba8 e22821a8 5bc42524 58982e19 18dcf3c3 c5ddc64e 43f4242a
b266063b b9028c7d b4e075d2 0cfa5226 0e08e849 60dbbb59 655b4634 529e23f4
bea9e0de 7d2b87c6 12fc73d2 28d434a0 a5e65aed d2e186bd 48c8e7c1 f9c33436
017b4770 1203aae0 8fb912aa 61765dd5 e59b2c56 41ee8d6c 527bc775 e54a2f5a
quit
crypto ikev1 enable outside
crypto ikev1 policy 20
authentication rsa-sig
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 30
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 50
authentication rsa-sig
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 60
authentication pre-share
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 80
authentication rsa-sig
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 90
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 110
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 120
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 140
authentication rsa-sig
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 150
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400

HI-NO-KUNI(config)# SHOW ROUTE

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
Gateway of last resort is not set

D 10.4.4.4 255.255.255.255
[90/130816] via 136.1.47.4, 01:25:58, outside
D 136.1.23.0 255.255.255.0 [90/28416] via 136.1.37.3, 00:17:08, inside
C 136.1.37.0 255.255.255.0 is directly connected, inside
L 136.1.37.1 255.255.255.255 is directly connected, inside
C 136.1.47.0 255.255.255.0 is directly connected, outside
L 136.1.47.1 255.255.255.255 is directly connected, outside
D 172.16.96.0 255.255.255.0 [90/30976] via 136.1.37.3, 00:16:34, inside
S 192.168.100.1 255.255.255.255 [1/0] via 136.1.37.3, inside

HI-NO-KUNI(config)#

packet-tracer input inside icmp 192.168.100.1 8 0 10.4.4.4

Phase: 5
Type: WEBVPN-SVC
Subtype: in
Result: DROP

VPN CLIENT

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\jomoc>ipconfig

Windows IP Configuration

Ethernet adapter Local Area Connection 3:

Connection-specific DNS Suffix . :
IPv4 Address. . . . . . . . . . . : 192.168.100.1
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.100.2

Ethernet adapter Bluetooth Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : inelab.local
Link-local IPv6 Address . . . . . : fe80::a4db:4b0a:205a:78b1%11
IPv4 Address. . . . . . . . . . . : 172.16.96.100
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 172.16.96.2

Tunnel adapter isatap.{4D438EBB-816C-4D8D-B788-8C34A27993DF}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.inelab.local:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : inelab.local

Tunnel adapter isatap.{A90BE4A2-DA9E-4CAD-ABA7-B76F5CAA4025}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

C:\Users\jomoc>
C:\Users\jomoc>
C:\Users\jomoc>
C:\Users\jomoc>
C:\Users\jomoc>
C:\Users\jomoc>routeprint
'routeprint' is not recognized as an internal or external command,
operable program or batch file.

C:\Users\jomoc>route print
===========================================================================
Interface List
21...00 05 9a 3c 7a 00 ......Cisco AnyConnect Secure Mobility Client Virtual Mi
niport Adapter for Windows
14...3c a0 67 f1 44 20 ......Bluetooth Device (Personal Area Network)
11...00 0c 29 f4 a9 d4 ......Intel(R) PRO/1000 MT Network Connection
1...........................Software Loopback Interface 1
12...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
23...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 172.16.96.2 172.16.96.100 10
0.0.0.0 0.0.0.0 192.168.100.2 192.168.100.1 2
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
136.1.37.1 255.255.255.255 172.16.96.2 172.16.96.100 11
172.16.96.2 255.255.255.255 On-link 172.16.96.100 11
172.16.96.100 255.255.255.255 On-link 172.16.96.100 266
192.168.100.0 255.255.255.0 On-link 192.168.100.1 257
192.168.100.1 255.255.255.255 On-link 192.168.100.1 257
192.168.100.255 255.255.255.255 On-link 192.168.100.1 257
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 172.16.96.100 266
224.0.0.0 240.0.0.0 On-link 192.168.100.1 257
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 172.16.96.100 266
255.255.255.255 255.255.255.255 On-link 192.168.100.1 257
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 192.168.100.2 1
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
11 266 fe80::a4db:4b0a:205a:78b1/128
On-link
1 306 ff00::/8 On-link
11 266 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

C:\Users\jomoc>
C:\Users\jomoc>
C:\Users\jomoc>
C:\Users\jomoc>ping 10.4.4.4

Pinging 10.4.4.4 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 10.4.4.4:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\Users\jomoc>route print
===========================================================================
Interface List
21...00 05 9a 3c 7a 00 ......Cisco AnyConnect Secure Mobility Client Virtual Mi
niport Adapter for Windows
14...3c a0 67 f1 44 20 ......Bluetooth Device (Personal Area Network)
11...00 0c 29 f4 a9 d4 ......Intel(R) PRO/1000 MT Network Connection
1...........................Software Loopback Interface 1
12...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
23...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 172.16.96.2 172.16.96.100 10
0.0.0.0 0.0.0.0 192.168.100.2 192.168.100.1 2
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
136.1.37.1 255.255.255.255 172.16.96.2 172.16.96.100 11
172.16.96.2 255.255.255.255 On-link 172.16.96.100 11
172.16.96.100 255.255.255.255 On-link 172.16.96.100 266
192.168.100.0 255.255.255.0 On-link 192.168.100.1 257
192.168.100.1 255.255.255.255 On-link 192.168.100.1 257
192.168.100.255 255.255.255.255 On-link 192.168.100.1 257
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 172.16.96.100 266
224.0.0.0 240.0.0.0 On-link 192.168.100.1 257
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 172.16.96.100 266
255.255.255.255 255.255.255.255 On-link 192.168.100.1 257
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 192.168.100.2 1
===========================================================================

[Francesco Molino]

Hi

Can you share your asa configuration please because we don't see the nat and acls in the config snippet you shared.