cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
7762
Views
0
Helpful
5
Replies

Anyconnect ASA cannot access internal network or internet

aparikh
Level 1
Level 1

After connecting via anyconnect client 2.5, I cannot access my internal network or internet.

My Host is getting ip address of 10.2.2.1/24 & gw:10.2.2.2

Following is the config

ASA Version 8.2(5)

!

names

name 172.16.1.200 EOCVLAN198 description EOC VLAN 198

dns-guard

!

interface Ethernet0/0

description to EOCATT7200-G0/2

switchport access vlan 2

!

interface Ethernet0/1

description to EOC-Inside

switchport access vlan 198

!

!

interface Vlan1

shutdown

no nameif

security-level 100

no ip address

!

interface Vlan2

nameif outside

security-level 0

ip address 1.21.24.23 255.255.255.248

!

interface Vlan198

nameif inside

security-level 100

ip address 172.16.1.1 255.255.255.0

!

ftp mode passive

clock timezone PST -8

clock summer-time PDT recurring

dns server-group DefaultDNS

domain-name riversideca.gov

access-list outside_acl extended permit icmp any interface inside

access-list outside_acl extended permit ip any any

access-list inside_acl extended permit icmp any interface outside

access-list inside_acl extended permit icmp interface outside any

access-list inside_acl extended permit ip any any

access-list inside_acl extended permit ip 172.16.1.0 255.255.255.0 any

access-list inside_acl extended permit ip 10.0.0.0 255.0.0.0 any

access-list NONAT extended permit ip 10.10.10.0 255.255.255.0 10.2.2.0 255.255.255.0

access-list NONAT extended permit ip 10.2.2.0 255.255.255.0 10.10.10.0 255.255.255.0

access-list NONAT extended permit ip 10.10.86.0 255.255.255.0 10.2.2.0 255.255.255.0

access-list NONAT extended permit ip 10.2.2.0 255.255.255.0 10.10.86.0 255.255.255.0

access-list NONAT extended permit ip 10.80.1.0 255.255.255.0 10.2.2.0 255.255.255.0

access-list split-tunnel standard permit 172.16.1.0 255.255.255.0

access-list split-smart standard permit any

ip local pool SSLClientPool 10.2.2.1-10.2.2.50 mask 255.255.255.0

asdm image disk0:/asdm-649.bin

global (outside) 1 interface

nat (inside) 0 access-list NONAT

nat (inside) 1 172.16.1.0 255.255.255.0

nat (inside) 1 0.0.0.0 0.0.0.0

access-group outside_acl in interface outside

access-group inside_acl in interface inside

route outside 0.0.0.0 0.0.0.0 1.21.24.23 1

route inside 10.0.0.0 255.0.0.0 EOCVLAN198 1

route inside 192.168.1.0 255.255.255.0 EOCVLAN198 1

route inside 192.168.100.0 255.255.255.0 EOCVLAN198 1

route inside 192.168.211.0 255.255.255.0 EOCVLAN198 1

webvpn

enable outside

svc image disk0:/anyconnect-dart-win-2.5.3055-k9.pkg 1

svc enable

tunnel-group-list enable

group-policy SSLCLientPolicy internal

group-policy SSLCLientPolicy attributes

dns-server value 10.10.86.128 10.10.86.129

vpn-tunnel-protocol svc webvpn

split-tunnel-policy tunnelspecified

split-tunnel-network-list value split-smart

default-domain value yourname.tld

address-pools value SSLClientPool

username test password P4ttSyrm33SV8TYp encrypted privilege 15

username admin password fOGXfuUK21gWxwO6 encrypted privilege 15

tunnel-group SSLClientProfile type remote-access

tunnel-group SSLClientProfile general-attributes

default-group-policy SSLCLientPolicy

tunnel-group SSLClientProfile webvpn-attributes

group-alias EOCSSL enable

!

class-map global-class

class-map IPS

class-map my-ips-class

class-map test1

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny 

  inspect sunrpc

  inspect xdmcp

  inspect sip 

  inspect netbios

  inspect tftp

  inspect ip-options

  inspect ipsec-pass-thru

  inspect http

  inspect pptp

  inspect icmp

class global-class

  ips inline fail-close

class class-default

  set connection decrement-ttl

policy-map my-ips-policy

class my-ips-class

  ips promiscuous fail-open

!

service-policy global_policy global

p

ciscoasa#    show log

Syslog logging: enabled

Aug 02 2012 21:34:03: %ASA-6-302014: Teardown TCP connection 60662 for outside:10.2.2.1/62706 to outside:74.125.224.228/443 duration 0:00:00 bytes 0 Flow is a loopback (test)

Aug 02 2012 21:34:09: %ASA-6-302015: Built inbound UDP connection 60664 for outside:10.2.2.1/49768 (10.2.2.1/49768) to inside:10.10.86.128/53 (10.10.86.128/53) (test)

Aug 02 2012 21:34:09: %ASA-6-302014: Teardown TCP connection 60665 for outside:10.2.2.1/62706 to outside:74.125.224.228/443 duration 0:00:00 bytes 0 Flow is a loopback (test)

Aug 02 2012 21:34:10: %ASA-6-302015: Built inbound UDP connection 60666 for outside:10.2.2.1/49768 (10.2.2.1/49768) to inside:10.10.86.129/53 (10.10.86.129/53) (test)

Aug 02 2012 21:34:11: %ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:10.2.2.1/62708 dst inside:192.248.248.120/443 denied due to NAT reverse path failure

Aug 02 2012 21:34:21: %ASA-6-302015: Built inbound UDP connection 60668 for outside:10.2.2.1/50715 (10.2.2.1/50715) to inside:10.10.86.128/53 (10.10.86.128/53) (test)

Aug 02 2012 21:34:21: %ASA-6-302015: Built inbound UDP connection 60669 for outside:10.2.2.1/64333 (10.2.2.1/64333) to inside:10.10.86.128/53 (10.10.86.128/53) (test)

Aug 02 2012 21:34:22: %ASA-6-302015: Built inbound UDP connection 60670 for outside:10.2.2.1/50715 (10.2.2.1/50715) to inside:10.10.86.129/53 (10.10.86.129/53) (test)

Aug 02 2012 21:34:22: %ASA-6-302016: Teardown UDP connection 60474 for outside:10.2.2.1/50367 to inside:10.10.86.128/53 duration 0:02:01 bytes 40 (test)

Aug 02 2012 21:34:22: %ASA-6-302016: Teardown UDP connection 60475 for outside:10.2.2.1/60325 to inside:10.10.86.128/53 duration 0:02:01 bytes 46 (test)

Aug 02 2012 21:34:22: %ASA-6-302015: Built inbound UDP connection 60671 for outside:10.2.2.1/64333 (10.2.2.1/64333) to inside:10.10.86.129/53 (10.10.86.129/53) (test)

Aug 02 2012 21:34:22: %ASA-6-302014: Teardown TCP connection 60672 for outside:10.2.2.1/62713 to outside:74.125.224.228/443 duration 0:00:00 bytes 0 Flow is a loopback (test)

Aug 02 2012 21:34:23: %ASA-6-302016: Teardown UDP connection 60477 for outside:10.2.2.1/50367 to inside:10.10.86.129/53 duration 0:02:01 bytes 40 (test)

Aug 02 2012 21:34:23: %ASA-6-302016: Teardown UDP connection 60479 for outside:10.2.2.1/60325 to inside:10.10.86.129/53 duration 0:02:01 bytes 46 (test)

ciscoasa# show vpn-sessiondb svc

Session Type: SVC

Username     : test                   Index        : 21

Assigned IP  : 10.2.2.1               Public IP    : 76.95.186.82

Protocol     : Clientless SSL-Tunnel DTLS-Tunnel

License      : SSL VPN

Encryption   : RC4 AES128             Hashing      : SHA1

Bytes Tx     : 13486                  Bytes Rx     : 136791

Group Policy : SSLCLientPolicy        Tunnel Group : SSLClientProfile

Login Time   : 21:26:21 PDT Thu Aug 2 2012

Duration     : 0h:08m:41s

Inactivity   : 0h:00m:00s

NAC Result   : Unknown

VLAN Mapping : N/A                    VLAN         : none

1 Accepted Solution

Accepted Solutions

Split tunnel ACL is incorrect, you should add the internal LAN subnets, not the VPN pool subnets and also add the correct NONAT ACL.

If you are trying to access the 172.16.1.0/24 subnet, then add the following:

access-list NONAT extended permit ip 172.16.1.0 255.255.255.0 10.2.2.0 255.255.255.0

Then the following split tunnel ACL:

access-list split-smart standard permit ip 172.16.1.0 255.255.255.0

Lastly, try to see if you can ping 172.16.1.200 after adding the above.

View solution in original post

5 Replies 5

Jennifer Halim
Cisco Employee
Cisco Employee

You can add the following:

route outside 10.2.2.0 255.255.255.0 1.21.24.23 1

because you have 10.0.0.0/8 route pointing to the inside.

Also, do you need split tunnel, or are you trying to send all traffic to the ASA? because you have "permit any" for your split tunnel acl, that's why i asked.

If you want to send the VPN internet traffic towards the ASA too, then you need to configure:

nat (outside) 1 10.2.2.0 255.255.255.0

If you want to send the VPN internet traffic directly off local internet, then you would need to configure the correct split tunnel acl to only include subnet behind the ASA.

It did not work.

I added the "

route outside 10.2.2.0 255.255.255.0 1.21.24.23 1"

I also added "access-list split-smart standard permit ip 10.2.2.0 255.255.255.0"

I do not care about the split-tuunel.

MY Laptop IP address: 10.2.2.1, SM:255.255.255.0 GW:10.2.2.2

Split tunnel ACL is incorrect, you should add the internal LAN subnets, not the VPN pool subnets and also add the correct NONAT ACL.

If you are trying to access the 172.16.1.0/24 subnet, then add the following:

access-list NONAT extended permit ip 172.16.1.0 255.255.255.0 10.2.2.0 255.255.255.0

Then the following split tunnel ACL:

access-list split-smart standard permit ip 172.16.1.0 255.255.255.0

Lastly, try to see if you can ping 172.16.1.200 after adding the above.

It is working.

I added the "address-pool" under the tunnel-group xxx general-attribute"

Thanks for taking time to respond.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: