Can not get data flow through a RA-VPN

[TheGoob]

Hello

So I followed this guide https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215532-configure-remote-access-vpn-on-ftd-manag.html

And after I set it all up, I have verified via CLI that I am indeed connected [from ihpone] using the

show vpn-sessiondb anyconnect

I connect but I can n ping 8.8.8.8, google.com or any LAN IP. It is like it connects, to nothing.

The only variation I had done was create my own cert, as I have no existing cert to upload, so maybe on the cert I selected an incorrect security or something.. Also, I wanna verify...

Local Address Assignment to AnyConnect = the fake new virtual IP network to connect to, NOT on my existing FTD

and

local network behind the FDM = the existing Network I want my VPN to have access to? or is this also a new virtual ip network?

[liviu.gheorghe]

Hello,

for the local addresses assigned to VPN clients, have you configured:

1. an ACL entry to allow them access to the Internet and another ACL entry to allow them access to your internal network?

2. a NAT entry for when they go to the Internet?

[TheGoob]

Oh.. I guess I was too literal to the guide, as I did not make such rules. I had assumed doing all this would do that in the background.

[liviu.gheorghe]

I'm afraid there is no such thing when it comes to firewalls :))

[TheGoob]

Yeah it was wishful thinking. Also, like I mentioned earlier.. The Anyconnect Local Address Assignment is the new "virtual" IP Network that my remote device connects to and the FDM Local Network, is that the pre-existing Network I want the RA to have access to? Or is it too a virtual,new FDM located Network?

[liviu.gheorghe]

"The Anyconnect Local Address Assignment" is a pool of IP addresses, called also VPN Pool in the documentation, that are used to provide an IP address to the users connecting via Cisco AnyConnect.

This pool of addresses should be viewed like a "virtual" network connected to the firewall and you should configure ACL entries for it in order to access the inside network.

And yes, the FDM Local Network, is the pre-existing Network you want the RA to have access to.

[TheGoob]

Interesting. Ugh I removed all my configuration last night cause it did not work. I will redo it then figure out how and where to make the ACL's/NAT.

[TheGoob]

Well this is where I am running into an issue.

1.) I already have a NAT for the 192.168.5.0/24 [LAN]  with x.x.x.182 [WAN]

When I create another NAT for the FDM_Anyconnect_Inside_Pool, which is also 192.158.5.0/24 with x.x.x.182 it errors and says it is overlapping.

2.) As far as an ACL rule, does not 'any' and 'any' already incorporate the new Anyconnect_Pool 10.0.1.0/24?

[liviu.gheorghe]

1. You need to assign the VPN pool a unique subnet, not used on any other connected interface in the firewall.

2. Yes it does, but I would configure them more specific.

[TheGoob]

Ahh, I then probably asked my question earlier wrong.

I have a Network 192.168.5.0/24 which IS the actual LAN I use now... When creating, for the VPN, a FDM_Local_Pool, this is yet ANOTHER LAN Subnet outside of my existing?

So, in the end, I will have the Virtual Anyconnect [10.0.1.0/24] the FDM_Local [192.168.10.0/24 (Made specifically for the VLN/LAN)] and then then existing LAN 192.168.5.0/24 that I will then give access to?

[liviu.gheorghe]

---

I have a Network 192.168.5.0/24 which IS the actual LAN I use now... When creating, for the VPN, a FDM_Local_Pool, this is yet ANOTHER LAN Subnet outside of my existing?

Yes, that is correct. You define the VPN pool in the firewall configuration like this https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215532-configure-remote-access-vpn-on-ftd-manag.html#toc-hId-2085974521

So, in the end, I will have the Virtual Anyconnect [10.0.1.0/24] the FDM_Local [192.168.10.0/24 (Made specifically for the VLN/LAN)] and then then existing LAN 192.168.5.0/24 that I will then give access to?

---

You only need the VPN Anyconnect pool [10.0.1.0/24 for example] and the existing LAN 192.168.5.0/24 that you will then give access to.

I don't really understand what do you mean by "FDM_Local [192.168.10.0/24 (Made specifically for the VLN/LAN)]".

[TheGoob]

Alright, what I mean is when that guide says ' local network behind the FDM device' are they referring to the per-existing LAN I already have, I.E 192.168.5.0/24?

[liviu.gheorghe]

Correct.

[TheGoob]

Then something else is wrong, because if the Anyconnect_Pool would be defined under "any" in an ACL that I have and then the Existing LAN Network [192.168.5.0/24] has a NAT for a x.x.x.182 WAN IP...I should get throughput after a successful connection, but I do not.

When I connect, this is was the CLI says;

Session Type: AnyConnect

Username     : Anyconnect             Index        : 2

Assigned IP  : 10.0.1.1               Public IP    : 108.147.173.76

Protocol     : AnyConnect-Parent SSL-Tunnel

License      : AnyConnect Premium, AnyConnect for Mobile

Encryption   : AnyConnect-Parent: (1)none  SSL-Tunnel: (1)AES-GCM-128

Hashing      : AnyConnect-Parent: (1)none  SSL-Tunnel: (1)SHA256

Bytes Tx     : 3118                   Bytes Rx     : 20045

Group Policy : DfltGrpPolicy          Tunnel Group : Anyconnect_VPN

Login Time   : 00:40:22 UTC Sat Mar 1 2025

Duration     : 0h:04m:04s

Inactivity   : 0h:00m:00s

VLAN Mapping : N/A                    VLAN         : none

Audt Sess ID : cb0071820000200067c25776

Security Grp : none                   Tunnel Zone  : 0

[liviu.gheorghe]

Maybe I didn't understand correctly what you where asking and there are a few things that might need attention.

Here is a video guide on how to configure RA VPN on the FTD: https://www.youtube.com/watch?v=Bov4BBCQeas

The configuration part is very short, first 10 minutes, and it touches all important steps you need to take care in order to make it work.