ASA U-turn traffic not working

[martino-cisco]

Hello,

I have a site-to-site VPN between two remote sites which is working as expected. LAN subnets at both sites are allowed for access over the VPN. I would like to be able to access the remote site when connecting remotely via AnyConnect to the local site. And so to achieve this, I have:

- Configured a NAT rule to NAT the AnyConnect range to an unused range when the destination is the subnet of the remote end of the VPN tunnel. This means that in my NAT rule, the source interface is OUTSIDE and the destination interface is also OUTSIDE.

-Configured an access-list to allow the Anyconnect range outbound access

-Enabled 'same-security permit intra-interface' traffic

-Added the unused range I'm NAT'ing to to cryptomaps at both ends of the tunnel and verified the remote end is configured to route traffic for this 'unused' subnet via the VPN tunnel

I'm able to connect successfully to the remote site from the internal LAN on the local end. However, when testing from the AnyConnect range, it fails.

- I see ICMP traffic hit the firewall but it doesn't seem to go any further

-When testing TCP traffic, I just get a SYN timeout from the ASA logs

-It does even seem to get to the stage of traversing the VPN tunnel as the VPN tunnel doesn't come up even if I leave continuous pings running (i cleared the VPN tunnel to ensure it was down before testing from the Anyconnect range)

-Traceroute fails from the first hop

When I use the packet-tracer utility on ASDM, it shows the flow is allowed, showing the correct NAT translations, the correct policy and confirming it goes over the VPN. But testing from an actual machine, I get nothing.

Any thoughts on what could be blocking this? 

[Francesco Molino]

Hi

Why are you using another network? You can use the same and do a nat exemption.
You've added this new network into your crypto acl, but what about the other end?
Do you have a full tunnel or split tunnel?
If split tunnel, i believe you've added the remote LAN subnet because you said you have seen packets reaching asa.
Do you have any filter acl for anyconnect clients?

Can you share please your config and output of packet-tracer?

[martino-cisco]

Hi Francesco,

Thanks for getting back to me. I have now resolved this. It turned out to be a human issue and not a firewall issue unfortunately. The person configuring the remote end had added the new subnet but did not commit the change (as required with that firewall vendor) and so it was not applied to the running config.

[Francesco Molino]

Ok, thanks for letting us know and glad everything works now.