hi - was from my side just a matter of the permitted protocols - have you solved your problem ? if not try to share a screenshot of the different policysettings - then can we probably quickly help you ... View more

ok ok - but firepower (FTD) is just another platform to terminate AnyConnect on - and well - maybe the ASAv here would still be a better solution because that has been there for really many years and works very well - it should solely be as "vpn-server" - and yes - flexvpn is an IOS technology and not that useably for roaming users.  But - is there other ways which just not has come to our mind of implementing Remote Access?  ... View more

well - if you are using the ASDM it sounds to me that you commit suicide... ... View more

and now we got at least the bridge functionality in the ASA OS 9.7 - well - even though I now risc to be known as a grumbling old man - that is a ugly implementation but ok - it is a start... ... View more

here is the output from the problematic router - currently the nat statement for vrf dk10 got removed - but the result is the same for the rest =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2015.12.12 20:44:13 =~=~=~=~=~=~=~=~=~=~=~= R0#sh run Building configuration... Current configuration : 2845 bytes ! ! Last configuration change at 20:42:02 UTC Sat Dec 12 2015 upgrade fpd auto version 15.2 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R0 ! boot-start-marker boot-end-marker ! ! vrf definition dk10  rd 65400:10  !  address-family ipv4  exit-address-family ! vrf definition dk20  rd 65400:20  !  address-family ipv4  exit-address-family ! vrf definition dk30  rd 65400:30  !  address-family ipv4  exit-address-family ! ! no aaa new-model no ip icmp rate-limit unreachable ! ! ! ! ! ! no ip domain lookup ip cef no ipv6 cef ! multilink bundle-name authenticated ! ! ! ! ! ! ! ! ! ! redundancy ! ! ip tcp synwait-time 5 ! ! ! ! ! ! ! ! ! ! interface Loopback10  vrf forwarding dk10  ip address 172.22.16.1 255.255.255.255 ! interface Loopback20  vrf forwarding dk20  ip address 172.22.16.1 255.255.255.255 ! interface Loopback30  vrf forwarding dk30  ip address 172.22.16.1 255.255.255.255 ! interface FastEthernet0/0  no ip address  duplex auto  speed auto ! interface FastEthernet0/0.1  encapsulation dot1Q 10  vrf forwarding dk10  ip address 100.112.10.1 255.255.255.0 ! interface FastEthernet0/0.2  encapsulation dot1Q 20  vrf forwarding dk20  ip address 100.112.20.1 255.255.255.0 ! interface FastEthernet0/0.3  encapsulation dot1Q 30  vrf forwarding dk30  ip address 100.112.30.1 255.255.255.0 ! interface FastEthernet0/1  ip address 100.112.0.2 255.255.255.0  ip nat outside  ip virtual-reassembly in  ip policy route-map to-vrf  duplex auto  speed auto ! ip forward-protocol nd no ip http server no ip http secure-server ! ! ip nat inside source static network 172.22.16.0 100.112.2.0 /24 vrf dk20 extendable match-in-vrf ip nat inside source static network 172.22.16.0 100.112.3.0 /24 vrf dk30 extendable match-in-vrf ip route 0.0.0.0 0.0.0.0 100.112.0.1 ip route vrf dk10 0.0.0.0 0.0.0.0 100.112.0.1 global ip route vrf dk20 0.0.0.0 0.0.0.0 FastEthernet0/1 100.112.0.1 ip route vrf dk30 0.0.0.0 0.0.0.0 FastEthernet0/1 100.112.0.1 ! access-list 101 permit ip any 100.112.10.0 0.0.0.255 access-list 101 permit ip any 100.112.1.0 0.0.0.255 access-list 102 permit ip any 100.112.20.0 0.0.0.255 access-list 102 permit ip any 100.112.2.0 0.0.0.255 access-list 103 permit ip any 100.112.30.0 0.0.0.255 access-list 103 permit ip any 100.112.3.0 0.0.0.255 no cdp log mismatch duplex ! route-map to-vrf permit 10  match ip address 101  set vrf dk10 ! route-map to-vrf permit 20  match ip address 102  set vrf dk20 ! route-map to-vrf permit 30  match ip address 103  set vrf dk30 ! ! ! control-plane ! ! ! mgcp profile default ! ! ! gatekeeper  shutdown ! ! line con 0  exec-timeout 0 0  privilege level 15  logging synchronous  stopbits 1 line aux 0  exec-timeout 0 0  privilege level 15  logging synchronous  stopbits 1 line vty 0 4  login  transport input all ! ! end R0# and here is a drawing of the topology ... View more

hi Again Thanks for the suggestion - looked at it was just the solution - but - I cannot get it to Work - see here (deb ip nat detailed, deb ip policy and deb ip icmp) *Dec 12 20:01:22.351: NAT: i: icmp (172.22.16.1, 10) -> (100.112.0.1, 10) [54] *Dec 12 20:01:22.351: NAT: s=172.22.16.1->100.112.1.1, d=100.112.0.1 [54] *Dec 12 20:01:22.371: IP: s=100.112.0.1 (FastEthernet0/1), d=100.112.1.1, len 100, FIB policy match *Dec 12 20:01:22.371: IP: s=100.112.0.1 (FastEthernet0/1), d=100.112.1.1, len 100, PBR Counted *Dec 12 20:01:22.371: IP: s=100.112.0.1 (FastEthernet0/1), d=100.112.1.1, len 100, FIB policy routed set vrf *Dec 12 20:01:22.371: IP: s=100.112.0.1 (FastEthernet0/1), d=100.112.1.1, len 100, FIB policy match *Dec 12 20:01:22.371: IP: s=100.112.0.1 (FastEthernet0/1), d=100.112.1.1, len 100, FIB policy routed set vrf. Success rate is 0 percent (0/5) R0#sh ip cef vrf dk10 Prefix               Next Hop             Interface 0.0.0.0/0            100.112.0.1          FastEthernet0/1 0.0.0.0/8            drop 0.0.0.0/32           receive 100.112.1.0/24       receive 100.112.10.0/24      attached             FastEthernet0/0.1 100.112.10.0/32      receive              FastEthernet0/0.1 100.112.10.1/32      receive              FastEthernet0/0.1 100.112.10.255/32    receive              FastEthernet0/0.1 127.0.0.0/8          drop 172.22.16.1/32       receive              Loopback10 224.0.0.0/4          drop 224.0.0.0/24         receive 240.0.0.0/4          drop 255.255.255.255/32   receive R0# ... View more