Hey Rahul,   I'll have to check if there is any other server on that subnet. But, I would assume I won't be able to ping them.   Does the Split exclude look like #1, in the screenshot below?   -Matt ... View more

It actually looks like just using the original file they sent me worked, and that it was just some issue with my phone and the MOH... Thanks for the help anyway, much appreciated! -Matt ... View more

Ok, so I added 192.168.1.100/32 to the ACE that's assigned to the Split-Tunnel. Still couldn't ping that SMB server's address when "Allow Local LAN Access" is enabled through AnyConnect client.   Some IPs you'll see in output below: 10.40.111.18 - Client's VPN Address 192.168.1.100 - File server address inside corporate network 10.40.1.3 - Internal DNS Server 192.168.5.30 - Internal DNS Server 192.168.1.4 - Local LAN IP of Client 192.168.1.8 - Local Printer inside Client's LAN   Route From Client (*and pings): C:\Users\Matt>route print =========================================================================== Interface List 33...00 05 9a 3c 7a 00 ......Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows 13...1c 65 9d af 4f a0 ......Bluetooth Device (Personal Area Network) 11...58 94 6b ac e5 74 ......Intel(R) Centrino(R) Advanced-N 6200 AGN 10...5c 26 0a 33 b9 8a ......Intel(R) 82577LM Gigabit Network Connection 1...........................Software Loopback Interface 1 30...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter 15...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface 32...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3 =========================================================================== IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.4 281 10.0.0.0 255.0.0.0 10.40.111.1 10.40.111.18 2 10.40.1.3 255.255.255.255 10.40.111.1 10.40.111.18 2 10.40.111.0 255.255.255.0 On-link 10.40.111.18 257 10.40.111.18 255.255.255.255 On-link 10.40.111.18 257 10.40.111.255 255.255.255.255 On-link 10.40.111.18 257 65.127.169.70 255.255.255.255 192.168.1.1 192.168.1.4 26 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 192.168.0.0 255.255.0.0 10.40.111.1 10.40.111.18 2 192.168.1.0 255.255.255.0 On-link 192.168.1.4 281 192.168.1.1 255.255.255.255 On-link 192.168.1.4 26 192.168.1.4 255.255.255.255 On-link 192.168.1.4 281 192.168.1.100 255.255.255.255 10.40.111.1 10.40.111.18 2 192.168.1.255 255.255.255.255 On-link 192.168.1.4 281 192.168.5.30 255.255.255.255 10.40.111.1 10.40.111.18 2 224.0.0.0 240.0.0.0 On-link 127.0.0.1 306 224.0.0.0 240.0.0.0 On-link 192.168.1.4 281 224.0.0.0 240.0.0.0 On-link 10.40.111.18 10000 255.255.255.255 255.255.255.255 On-link 127.0.0.1 306 255.255.255.255 255.255.255.255 On-link 192.168.1.4 281 255.255.255.255 255.255.255.255 On-link 10.40.111.18 10000 =========================================================================== Persistent Routes: None IPv6 Route Table =========================================================================== Active Routes: If Metric Network Destination Gateway 1 306 ::1/128 On-link 1 306 ff00::/8 On-link =========================================================================== Persistent Routes: None C:\Users\Matt> ping 192.168.1.100 Pinging 192.168.1.100 with 32 bytes of data: General failure. General failure. General failure. General failure. Ping statistics for 192.168.1.100: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), C:\Users\Matt> ping 192.168.1.8 Pinging 192.168.1.8 with 32 bytes of data: Reply from 192.168.1.8: bytes=32 time=19ms TTL=255 Reply from 192.168.1.8: bytes=32 time=15ms TTL=255 Reply from 192.168.1.8: bytes=32 time=9ms TTL=255 Reply from 192.168.1.8: bytes=32 time=7ms TTL=255 Ping statistics for 192.168.1.8: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 7ms, Maximum = 19ms, Average = 12ms -Matt ... View more

Hey Rahul, thanks for the reply. So on the Group Policy > "Employee-GP" > Split-Tunnel > Edit/Manage "Network List" > and add a Permit 192.168.1.100/32...? If so, I believe I tried that already yesterday and it didn't seem to help. But, I can test it again to make sure. I'll post back with results. Would that addition to the ACE need to be before the other entries? -Matt ... View more

Right, that screenshot was the format of the original file I received. Which according to the link I posted should work anyway..   Creating Audio Sources Most standard wav files serve as valid input audio source files, including the following file types: •16-bit PCM (stereo/mono) •8-bit CCITT a-law or mu-law (stereo/mono) I was only mentioning that PCM was one of the file types that I had attempted using. Which BTW, when I converted to PCM it went from about 1.5 MB up to 30 MB...   But, it's apparently working. So for some reason it wasn't working on my phone. But, I don't need the MOH on my phone anyway, so that's not a problem.   -Matt ... View more

Thanks for the reply, sorry for the confusion... Basically, the 192.168.1.100 is a SMB server where everyone's different share drives live. If a user's home network uses 192.168.1.0/24 for their local LAN, and they have "Local LAN Access" enabled, they cannot reach the server because it would look for it in the Local network at the employee's home since they are using the same subnet locally. If they were to disable Local LAN Access, then they can reach the server just fine since everything would get sent over the VPN tunnel, but they wouldn't be able to print to a printer located in their home. So I'm wondering if there is a way on the ASA to make it so they can reach that server and still be able to use Local LAN Access? I tried adding a "permit 192.168.1.100 255.255.255.255" to the split tunnel's ACL, but that didn't seem to make a difference. Does that make sense? -Matt ... View more

Thanks. Yea, I found that same info here at the link below. This is the doc I've used in the past to create my own MOH files, or to convert mp3's for MOH audio sources: https://community.cisco.com/t5/collaboration-voice-and-video/configuring-custom-media-files-for-music-on-hold/ta-p/3144809 -Matt ... View more

Apparently this IS working... Maybe there was just an issue with my phone. Cause the manager in the location where I enabled this said its working. Sorry for the question. -Matt ... View more

So do you mean I don't need to specify the return traffic for DNS in the ACL 150? I still need to specify it in ACL 160 though, right?   Also, we are upgrading our Domain servers soon so the address is going to change. So I'm going to try using an object-group for the DNS Servers (*and ISE Server addresses) so I only need to modify the address in one place. I haven't used object-groups before, but from some of what I saw in other posts (*correct me if I'm wrong) I believe I use the "network" option, *i.e. "object-group network <WORD>"   I didn't change anything in the Policy/Class-Maps, as shown in my previous post. But, I'll modify the ACL to look like the following: ! object-group network DNS-Servers description Internal DNS Servers host 10.30.5.35 host 10.40.1.3 ! object-group network ISE-Servers description Cisco ISE - PSN Servers host 10.30.2.49 host 10.40.10.49 ! !.... ! access-list 150 permit udp any object-group DNS-Servers eq domain access-list 150 permit tcp any object-group DNS-Servers eq domain access-list 150 permit tcp any object-group ISE-Servers eq 8443 access-list 160 permit udp object-group DNS-Servers eq domain any access-list 160 permit tcp object-group DNS-Servers eq domain any access-list 160 permit tcp object-group ISE-Servers any ! So in ACL 150 I'm covering traffic FROM the Guest client TO the DNS-Servers, as well as tcp traffic on port 8443 TO the ISE-Servers.   Then, in ACL 160 (*the return traffic), I'm permitting traffic FROM the DNS-Servers TO the Guest clients, as well as allowing ANY tcp traffic FROM the ISE-Servers TO the Guest clients.   Do you see anything wrong with that configuration above?   Thanks again for your help, much appreciated!   -Matt ... View more

Hey, thanks for the reply, much appreciated.   I guess I should have mentioned this in the OP... So the ACL in question is applied with a Policy/Class-Map. Basically, this is a remote branch office, which has a WAN connection on the Serial Port back to the HQ office where the DNS Servers are located. So technically there's a second ACL for return traffic. Sorry I didn't mention that.   Here's the configuration, using the DNS Host IPs instead of "any". Can you let me know if this looks correct to you? class-map type inspect match-any PUBWIFI_WAN match access-group 150 class-map type inspect match-any WAN_PUBWIFI match access-group 160 ! !...... ! policy-map type inspect WAN_PUBWIFI-Policy class type inspect WAN_PUBWIFI pass class class-default drop log policy-map type inspect PUBWIFI_WAN-Policy class type inspect PUBWIFI_WAN pass class class-default drop log ! !...... ! zone security PUBWIFI zone security WAN zone-pair security PUBWIFI-WAN source PUBWIFI destination WAN service-policy type inspect PUBWIFI_WAN-Policy zone-pair security WAN-PUBWIFI source WAN destination PUBWIFI service-policy type inspect WAN_PUBWIFI-Policy ! !...... ! access-list 150 permit udp any host <dns-server-1> eq domain access-list 150 permit tcp any host <dns-server-1> eq domain access-list 150 permit udp any host <dns-server-2> eq domain access-list 150 permit tcp any host <dns-server-2> eq domain access-list 150 permit tcp any host <primary-ise-ip> eq 8443 access-list 150 permit tcp any host <secondary-ise-ip> eq 8443 access-list 160 permit udp host <dns-server-1> eq domain any access-list 160 permit tcp host <dns-server-1> eq domain any access-list 160 permit udp host <dns-server-2> eq domain any access-list 160 permit tcp host <dns-server-2> eq domain any access-list 160 permit ip host <primary-ise-ip> any access-list 160 permit ip host <secondary-ise-ip> any Does that all look correct?   Also, if you don't think the tcp ones for DNS are necessary, I'll remove them. I was just going off that DNS example from the link in my original post.   Thanks Again, Matt ... View more