Hi Thiago, Please provide the detail of the show vpn-sessdb remote filter name and sho run group-policy and also send the output of the show run all group-policy Regards Raj ... View more

Hi Robert, The configuration for the DHCP relay across the Site to Site tunnel was not correct and that's the reason why it was not working In the crypto ACL you need to add the outside ip to the DHCP serevr as well and the Vice versa on the remote end So the correct Crypto acl would have been like this access-list L2LVPN extended permit ip 10.1.13.0 255.255.255.0 10.1.99.0 255.255.255.0 access-list L2LVPN extended permit ip host 213.8.x.x 10.1.99.0 255.255.255.0 Since you already have the inside network in the crypto ACL so we are not adding the inside interface otherwise we would have to add that as well. Basic understanding of the DHCP relay 1. Client  starts the DHCP process by sending a DHCPDISCOVER message to destination address     255.255.255.255  - UDP port 67 2. ASA sees the broadcast and based on the dhcprelay server config it forwards the DHCPDISCOVER     message as a unicast packet to the server's IP sourcing from the interface IP close to the server.     In this case the outside IP address. 3. Server sends back DHCPOFFER as a unicast packet to the ASA - UDP port 67     Server will send it to the destination IP address of the inside interface (giaddr) which is the     dhcprelay enabled interface. 4. This packet will arrive on the outside interface and will be broadcast out the inside interface - UDP port 68. 5. Client receives the DHCPOFFER, and sends a DHCPREQUEST message to the server, that it accepts the offer. 6. The server will send back a DHCPACK message to the client. 7. Client upon receiving the DHCPACK, it will start communicating on the network. This is how the DHCP relay would work across the site to site tunnel. HTH!!! Regards Raj Kumar                                                        Please rate all helpful posts ... View more

Hi Please try the following. It seems that you might be hiting this bug CSCtc71135 Please try the following as the workaround. webvpn error-recovery disable To get the fix please upgarde it to 8.2(5) HTH!!! Regards Raj Kumar                                       Please rate all helpful posts ... View more

Hi Neda Anyconnect with Internet connection sharing is not supported ICS has to be disabled in order to use the Anyconnect. HTH Regards Raj Kumar                           Please rate all helpful posts ... View more

Hi If you are using vpn-tunnel-protocol ikev1   Then you will not be able to connect to Anyconnect. Anyconnect supports SSL-Client or Ikev2 For Ipsec connection. If Ikev1 is used then its the Ipsec client that is used for the connection not the Anyconect. HTH Regards Raj Kumar ... View more

Hi Martin, As I correctly understand you have made the ASA as local Certificate authority and you are trying to get the client certificate from the Local CA which is ASA. The Local CA maintains its own user database of SSL VPN users. Console: crypto ca server user-db add email dn ASDM: Configuration > Remote Access VPN > Certificate Management > Local Certificate Authority > Manage User Database The Local CA only supports user enrollment through it's enrollment  interface at the following url.  Enrollments can only be done on  interfaces where webvpn is enabled. https:// /+CSCOCA+/enroll.html HTH Regards Raj Kumar                                                     Please rate all helpful posts ... View more

Hi Seyi, The problem lies here if you check the ouput of the debug dap trace of the client Pc which is as follow DAP_TRACE: dap_install_endpoint_data_to_lua:endpoint.anyconnect.clientversion="3.1.03103" DAP_TRACE: name = endpoint.anyconnect.clientversion, value = "3.1.03103" DAP_TRACE: dap_install_endpoint_data_to_lua:endpoint.anyconnect.platform="win" DAP_TRACE: name = endpoint.anyconnect.platform, value = "win" DAP_TRACE: Username: user1, Selected DAPs: DAP_TRACE: dap_process_selected_daps: selected 0 records DAP_TRACE: Username: user1, dap_aggregate_attr: rec_count = 1 DAP_TRACE: Username: user1, Selected DAPs: DfltAccessPolicy I don't see it looking for OS version Check. Ideally it should and this entry should have been there in the debug dap trace endpoint["os"]["version"], value = "Windows 7 And in the DAP policy that you have created you have mentioned 2 end point attributes to be checked which are as follow endpoint.anyconnect.clientversion, value = "3.1.03103 endpoint["os"]["version"], value = "Windows 7 Since it is not matching both the enpoint attributes it is falling on the DfltAccessPolicy Please let me know the host scan image that you have got. Try with the hostscan_3.1.03103-k9.pkg. And then check. HTH Regards Raj Kumar ... View more