Here are the outputs you requested. The packet tracer output shows I can ping from the Anyconnect subnet to the inside subnet. I always try to ping the inside gateway 10.0.1.1 once I establish an Anyconnect connection & never get a reply. As far as I know the inside interface does reply to pings. I am having an inside user try it now. I also try to ping 8.8.8.8 once a connection is established & get no reply. I can ping 8.8.8.8 normally when I am on the inside with a 10.0.1.x address.
I also tried to connect from my work laptop using Anyconnect version 3.1 but I got denied after entering my local login attempt. I assume that version 3.1 is not compatible with the .pkg file I have loaded onto the ASA & that only versions in the 4.x range would work. Is that correct?
Mario365# sh run all sysopt
no sysopt connection timewait
sysopt connection tcpmss 1380
sysopt connection tcpmss minimum 0
sysopt connection permit-vpn
sysopt connection reclassify-vpn
no sysopt connection preserve-vpn-flows
no sysopt radius ignore-secret
no sysopt noproxyarp inside
no sysopt noproxyarp outside
Mario365#
____________________________________________________________________________
Mario365# packet-tracer input outside icmp 10.0.2.1 8 0 10.0.1.2 detail
Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
in 10.0.1.0 255.255.255.0 inside
Phase: 2
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (inside,outside) source static any any destination static ANYCONNECT_REMOTENET ANYCONNECT_REMOTENET no-proxy-arp route-lookup
Additional Information:
NAT divert to egress interface inside
Untranslate 10.0.1.2/0 to 10.0.1.2/0
Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group acl-outside in interface outside
access-list acl-outside extended permit icmp any any
Additional Information:
Forward Flow based lookup yields rule:
in id=0xcd104c00, priority=13, domain=permit, deny=false
hits=16076, user_data=0xca2b0e80, cs_id=0x0, use_real_addr, flags=0x0, protocol=1
src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0, tag=0
dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, tag=0, dscp=0x0
input_ifc=outside, output_ifc=any
Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside,outside) source static any any destination static ANYCONNECT_REMOTENET ANYCONNECT_REMOTENET no-proxy-arp route-lookup
Additional Information:
Static translate 10.0.2.1/0 to 10.0.2.1/0
Forward Flow based lookup yields rule:
in id=0xccd0bbb8, priority=6, domain=nat, deny=false
hits=0, user_data=0xc90b0758, cs_id=0x0, flags=0x0, protocol=0
src ip/id=10.0.2.0, mask=255.255.255.0, port=0, tag=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
input_ifc=outside, output_ifc=inside
Phase: 5
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xcbc8cfe0, priority=0, domain=nat-per-session, deny=true
hits=523671, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
input_ifc=any, output_ifc=any
Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xcc329f08, priority=0, domain=inspect-ip-options, deny=true
hits=494425, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
input_ifc=outside, output_ifc=any
Phase: 7
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xcc3299a8, priority=66, domain=inspect-icmp-error, deny=false
hits=111288, user_data=0xcc328fb8, cs_id=0x0, use_real_addr, flags=0x0, protocol=1
src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0, tag=0
dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, tag=0, dscp=0x0
input_ifc=outside, output_ifc=any
Phase: 8
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (inside,outside) source static any any destination static ANYCONNECT_REMOTENET ANYCONNECT_REMOTENET no-proxy-arp route-lookup
Additional Information:
Forward Flow based lookup yields rule:
out id=0xccc5ce08, priority=6, domain=nat-reverse, deny=false
hits=1, user_data=0xccd1df88, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
src ip/id=10.0.2.0, mask=255.255.255.0, port=0, tag=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
input_ifc=outside, output_ifc=inside
Phase: 9
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 514905, packet dispatched to next module
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_translate
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat
Module information for reverse flow ...
Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow
Mario365#
