Am able to connect to Anyconnect but can't access internal resources

[nofori111]

Hello Everybody,

I have configured my anyconnect VPN tunnel. I am able to connect to the vpn perfectly but I am unable to ping and rdp into any of my resources.

webvpn
enable ISP-0
anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
anyconnect enable
tunnel-group-list enable

ip local pool MY-IP-VPN 10.6.6.1-10.6.6.10 mask 255.255.255.0

tunnel-group ANYCONNECT type remote-access
tunnel-group ANYCONNECT general-attributes
address-pool MY-IP-VPN
default-group-policy ANYCONNECT-GROUP-POLICY
tunnel-group ANYCONNECT webvpn-attributes
group-alias ANYCONNECT enable

group-policy ANYCONNECT-GROUP-POLICY internal
group-policy ANYCONNECT-GROUP-POLICY attributes
dns-server value 4.2.2.2 8.8.8.8
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value ANYCONNECT-SPLIT
address-pools value MY-IP-VPN

[JP Miranda Z]

Hi nofori111,

The configuration of the tunnel-group and group-policy looks fine and also the webvpn config, can you add the information about the ACL ANYCONNECT-SPLIT and also the nonat used for this traffic, can you also add the information of the ASA version.

Hope this info helps!!

Rate if helps you!!

-JP- 

[nofori111]

webvpn
enable ISP-0
anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
anyconnect enable
tunnel-group-list enable

ip local pool MY-IP-VPN 10.6.6.1-10.6.6.10 mask 255.255.255.0

access-list ANYCONNECT-SPLIT standard permit 172.16.100.0 255.255.255.0
access-list ANYCONNECT-SPLIT standard permit 192.168.1.0 255.255.255.0

tunnel-group ANYCONNECT type remote-access
tunnel-group ANYCONNECT general-attributes
address-pool MY-IP-VPN
default-group-policy ANYCONNECT-GROUP-POLICY
tunnel-group ANYCONNECT webvpn-attributes
group-alias ANYCONNECT enable

group-policy ANYCONNECT-GROUP-POLICY internal
group-policy ANYCONNECT-GROUP-POLICY attributes
dns-server value 4.2.2.2 8.8.8.8
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value ANYCONNECT-SPLIT
address-pools value MY-IP-VPN

object-group network ALL-INTERNAL
network-object 192.168.1.0 255.255.255.0
network-object 172.16.100.0 255.255.255.0
exit

object-group ANYCONNECT-IP
network-object 10.6.6.0 255.255.255.0
exit

nat (INSIDE,OUTSIDE) source static ALL-INTERNAL ALL-INTERNAL destination static ANYCONNECT-IP ANYCONNECT-IP no-proxy-arp route-lookup

******** ISSUES*********************ISSUES*************ISSUES**************

1. I am unable to ping any resources on either 192.168.1.0 and 172.16.100.0 subnet

[JP Miranda Z]

Great,

So your configuration is fine, now this sounds just like a traffic issue, you can take captures on the inside interface while sending traffic from your anyconnect client and see if you are actually getting response:

Example:

capture test interface inside match ip host 192.168.1.x host 10.6.6.x

sh cap test --> to see the capture

Now if you see only echo request in case of testing with icmp that means the tunnel is fine and the ASA is doing what is supposed to do.

Hope this info helps!!

Rate if helps you!!

-JP- 

[nofori111]

It was just a matter of creating an access-list to permit all internal host to the Anyconnect IP address and applying the access-list to the inside interface.