If you're using OATH or SMS for the 2FA challenge then you're hitting a limitation with the MFA NPS extension" https://social.msdn.microsoft.com/Forums/sqlserver/en-US/1908fdad-51ba-46e3-ad51-a59c4f686c3e/anyconnect-client-using-nps-extension-with-sms-not-sending-avpair?forum=WindowsAzureAD I've seen this AV pairs returned just fine with the App verification/Phone call. HTH. ... View more

Choose - Add NAT rule before "NAT object" NAT rules, then: -Original packet- Source address: NAT_HOSTS_GROUP Destination address: SiteB_Internal_Lan  -Translated packet- Source NAT type: Dynamic PAT hide Source address: object_30.1.1.1  Destination address: SiteB_Internal_Lan  Run a packet tracer to confirm the NAT rule is picked when the proxy ACL gets hit. HTH.     ... View more

Looks like PFS is missing from the 5510 dynamic map: crypto dynamic-map DM_NMC_AHUS-CAMPING 1 set pfs group5 Configure the line above, if the problem persists, enable a conditional IKEv2 debug [platform|protocol] for the peer in question. HTH ... View more

In that case, your ISE should only required for authorization, DUO is taking care of authentication to the user DB and also sending the 2FA via the push so, there's no need to have the ISE check for username/password again. With the configuration below, you still have 2FA along with DACL/group policy assigned by the ISE and the users will only be presented with a single username/password text box while connecting to the VPN gateway: ================================================================================== aaa-server ISE protocol radius authorize-only aaa-server DUO protocol ldap|radius tunnel-group DefaultWEBVPNGroup general-attributes authentication-server-group DUO secondary-authentication-server-group ISE use-primary-username default-group-policy NoAccess authentication-attr-from-server secondary tunnel-group DefaultWEBVPNGroup webvpn-attributes authentication aaa secondary-pre-fill-username client hide use-common-password <dummypasswd> ================================================================================== ***The ISE authentication policy matching the request from the ASA NAS IP needs to be set to continue if authentication fails. This is expected since DUO is terminating the authentication but radius can't separate authentication from authorization, that's also why you need to send a common password. HTH.       ... View more

Likely, that's the root cause of your issue.   Run a "debug dap trace 255" and a "debug dap errors" from the ASA CLI when the user with the issue tries to VPN in. Capture a DART bundle afterwards and search for hostscan/csd related errors.   You can post a sanitized copy of the errors/logs if they're are not clear enough.   HTH ... View more

That error message can be misleading sometimes, a couple of important things to check:   The cert can’t be self-signed, it must be issued by a public or private CA.   The cert’s subject name needs to match exactly what you defined in your XML profile <HostAddress>vpn.blah.com</HostAddress>   If the IOS-XE running is older than 16.9.1, make sure you set the BypassDownloader to ‘true’ on your profile.   IOS-XE FlexVPN with Anyconnect     ... View more

Is hostscan/csd enabled under the webvpn config module? ... View more

Password storage is not supported with Anyconnect; so this is not possible.   Are you working with different user databases for the primary authentication and DUO? ... View more

From the ASA are you able to ping the gateway IP or something outside such as 8.8.8.8 Can you post the result of a show route? ... View more

That just means they belong to the default vlan 1. Are you able to ping the ASA's Inside IP from one of the internal hosts? Run a packet tracer and see if it's being stopped for some reason: packet-tracer input inside icmp <inside host IP>  8 0 8.8.8.8 __ __ Pablo ... View more

Angelo, Assuming that with "reserve nat" you're referring to the NAT control feature then that's correct, the use of this feature was deprecated since the introduction of code 8.3. The best practice for traffic access control is the use of security levels and access-lists. HTH Pablo ... View more

On top of what Philip added, there's no good reason to have "no-proxy-arp" in the port forwarding configuration. This should be enough: object network WebServer  nat (DMZ50,outside) static interface service tcp www www In regards to your syntax question it, the configuration is not case sensitive (at least not for this). The string with the space is just the switchport configuration syntax, it attaches a physical port to a particular vlan (L2 config). The vlan with no space is the SVI; this is your layer 3 interface used to route packets out or between the vlans. HTH __ __ Pablo ... View more