Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
876
Views
0
Helpful
1
Replies

ANyconnect client can establish VPN session but no network access

dbuckley77
Level 1
Level 1

‎03-22-2017 04:13 AM

We have remote access vpn setup on ASA 5505 using anyconnect client.  All clients can connect and establish sessions but cannot access anything  on inside network.  Below is the ASA config:

CH-IT-FW1# sh run
: Saved
:
: Serial Number: JMX1115Z1VS
: Hardware:   ASA5505, 256 MB RAM, CPU Geode 500 MHz
:
ASA Version 8.2(5)59
!
hostname CH-IT-FW1
domain-name nashua.city
enable password 5DvauU9v6Csl8a7g encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 10.100.6.101 citywsus
name 10.100.95.0 IT-Network description IT-Network for Dameware
name 10.100.6.38 cityrx2 description for anitvirus updates
name 10.100.250.128 NATexemptVPNpoolnew description allow VPN assigned IP without NAT
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!             
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 10.100.250.5 255.255.255.0
 ospf message-digest-key 5 md5 *****
 ospf authentication message-digest
!
interface Vlan2
 description Fairpoint Connection
 nameif outside_interface
 security-level 0
 ip address 72.71.247.96 255.255.255.0
!
interface Vlan3
 no nameif
 no security-level
 no ip address
!
banner exec **You have reached the XXXXXXXXXX.  Any unauthorized users will be prosecuted to the fullest extent of the law**
banner login XXXXXXXXXXXXXX - Authorized Users Only
banner login Un-authorized tampering with this equipment is punishable by law
banner login Do not attempt to login if you are not authorized
banner asdm You have reached a device that is the sole property of XXXXXXXXXXXX.  Unauthorized use that has not been given explicit permission by XXXXXXXXXX is prohiibited.  
banner asdm Any unauthorized users will be prosecuted to the fullest extent of the law.  If you have reached this device in error, you MUST disconnect immediately.  
boot system disk0:/asa825-59-k8.bin
no ftp mode passive
clock timezone Eastern -5
dns domain-lookup inside
dns domain-lookup outside_interface
dns server-group DefaultDNS
 name-server 10.100.5.2
 name-server 10.100.5.3
 domain-name nashua.city
object-group service DVR tcp
 description DVR Access Ports
 port-object range 9002 9005
object-group service LifeSize udp
 description LifeSize Video conferencing UDP Ports
 port-object eq 1719
 port-object range 2776 2777
object-group service LifeSizeTCP tcp
 description Video Conferencing TCP Port
 port-object eq 2776
object-group service Dameware-UDP udp
 description Open UDP port for Dameware remote control
 port-object eq 6129
object-group service Dameware-TCP tcp
 description Open ports for Dameware remote connection
 port-object range 6129 6130
access-list split_tunnel standard permit 10.100.0.0 255.255.0.0
access-list split_tunnel standard permit 10.200.30.0 255.255.255.0
access-list inside_nat0_outbound remark Allow access to VPN clients from internal network
access-list inside_nat0_outbound extended permit ip any NATexemptVPNpoolnew 255.255.255.224
access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.255.0.0 10.100.105.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 71.181.12.224 255.255.255.224
access-list inside_nat0_outbound remark Allow non-natted traffic for vpn clients
access-list inside_nat0_outbound extended permit ip any 10.100.250.64 255.255.255.224
access-list inside_nat0_outbound extended permit ip any 10.99.0.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 10.98.0.0 255.255.0.0
access-list limited extended deny ip any host 10.100.6.23
access-list limited extended permit ip any 10.100.4.0 255.255.255.0
access-list limited extended permit ip any 10.100.5.0 255.255.255.0
access-list limited extended permit ip any 10.100.6.0 255.255.255.0
access-list limited remark Allow in for ERP
access-list limited extended permit ip any 10.100.200.0 255.255.255.0
access-list AVC-limited-permits remark Allow in for ERP
access-list AVC-limited-permits extended permit ip any 10.100.200.0 255.255.255.0
access-list AVC-limited-permits extended permit ip any 10.100.4.0 255.255.255.0
access-list AVC-limited-permits extended permit ip any 10.100.5.0 255.255.255.0
access-list AVC-limited-permits extended permit ip any 10.100.6.0 255.255.255.0
access-list AVC-limited-permits extended permit ip any host 10.100.32.80
access-list AVC-limited-permits extended permit ip any 10.200.30.0 255.255.255.0
access-list AVC-limited-denies extended deny ip any host 10.100.6.23
access-list AVC-limited-denies extended deny ip any host 10.100.6.20
access-list outside_interface_nat0_outbound remark Allow In for AnyConnect VPN Clients
access-list outside_interface_nat0_outbound extended permit ip NATexemptVPNpoolnew 255.255.255.224 any
access-list outside_interface_access_in remark Allow in for Remote Connections to Video Conferencing unit
access-list outside_interface_access_in extended permit udp any host 72.71.247.88 object-group LifeSize inactive
access-list outside_interface_access_in remark Allow in for Remote Connections to Video Conferencing unit
access-list outside_interface_access_in extended permit tcp any host 72.71.247.88 object-group LifeSizeTCP inactive
access-list outside_interface_access_in remark Allow in for Pictometry Server - temp rule delete 12-1-11
access-list outside_interface_access_in extended permit tcp any host 72.71.247.88 eq https inactive
access-list limited-vpn standard permit 10.100.4.0 255.255.255.0
access-list limited-vpn standard permit 10.100.5.0 255.255.255.0
access-list limited-vpn standard permit 10.100.6.0 255.255.255.0
access-list limited-vpn standard permit 10.100.200.0 255.255.255.0
access-list limited-vpn standard permit 10.200.30.0 255.255.255.0
access-list limited-vpn standard permit 10.100.10.0 255.255.255.0
access-list limited-vpn standard permit 10.100.40.0 255.255.255.0
access-list limited-vpn standard permit 10.100.120.0 255.255.255.0
access-list limited-vpn standard permit IT-Network 255.255.255.0
access-list throttle extended permit ip 10.100.0.0 255.255.0.0 any
access-list AVC-fire-permits extended permit ip any 10.100.4.0 255.255.252.0
access-list AVC-fire-permits extended permit ip any 10.100.120.0 255.255.255.0
access-list AVC-fire-permits remark for dameware connection
access-list AVC-fire-permits extended permit ip any IT-Network 255.255.255.0
access-list AVC-fire-permits remark for windows updates
access-list AVC-fire-permits extended permit ip any host citywsus
access-list AVC-fire-permits remark for anti virus updates
access-list AVC-fire-permits extended permit ip any host cityrx2
pager lines 24
logging enable
logging monitor notifications
logging trap notifications
logging history notifications
logging asdm debugging
logging host inside 10.100.6.56
logging class auth history notifications trap notifications
logging class vpn history notifications trap notifications
logging class webvpn history notifications trap notifications
logging class ssl history notifications trap notifications
mtu inside 1500
mtu outside_interface 1500
ip local pool ssl_vpn_pool 10.100.250.49-10.100.250.62 mask 255.255.255.240
ip local pool ssl_vpn_pool_new 10.100.250.129-10.100.250.158 mask 255.255.255.224
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-645.bin
no asdm history enable
arp timeout 14400
global (outside_interface) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_interface_access_in in interface outside_interface
!
router ospf 1
 router-id 10.100.250.5
 network 10.100.250.0 255.255.255.0 area 0
 distance ospf intra-area 80 inter-area 80 external 150
 log-adj-changes
!
route outside_interface 0.0.0.0 0.0.0.0 72.71.247.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
ldap attribute-map Group-Map
  map-name  memberOf Group-Policy
  map-value memberOf "CN=VPNFire,OU=All Security Groups,OU=City of Nashua,DC=nashua,DC=city" AVC-GP
  map-value memberOf "CN=vpnusersadmin,OU=All Security Groups,OU=City of Nashua,DC=nashua,DC=city" AVC-Timmed-Test
dynamic-access-policy-record DfltAccessPolicy
 user-message "You must dress up in a snuffleupagus costume before you can connect to this network!!!"
 action terminate
dynamic-access-policy-record Local_Access_Policy
 description "Allow local users to access vpn with local database"
 user-message "Welcome.  Unauthorized access prohibited."
 priority 249
dynamic-access-policy-record AVC-admins
 description "AnyConnect with no limitation"
 user-message "Welcome, Admin, to the City of Nashua SSL Web service portal."
 priority 250
 webvpn
  svc ask none default svc
dynamic-access-policy-record AVC-Fire
 description "SSLVPN Policy for Fire Dept Users"
 network-acl AVC-fire-permits
 network-acl AVC-limited-denies
 priority 299
 webvpn
  svc ask enable default svc
dynamic-access-policy-record AVC-Limited
 description "Allow limited users VPN via AnyConnect"
 network-acl AVC-limited-permits
 network-acl AVC-limited-denies
 priority 301
 webvpn
  svc ask none default svc
aaa-server AVC-LDAP-SG protocol ldap
aaa-server AVC-LDAP-SG (inside) host 10.100.5.11
 ldap-base-dn DC=nashua,DC=city
 ldap-scope subtree
 ldap-naming-attribute sAMAccountName
 ldap-login-password *****
 ldap-login-dn CN=mgrjboss,OU=Resources,DC=nashua,DC=city
 server-type microsoft
 ldap-attribute-map Group-Map
aaa-server AVC-RADIUS protocol radius
aaa-server RADIUS protocol radius
 reactivation-mode timed
aaa-server RADIUS (inside) host 10.100.5.5
 retry-interval 5
 key *****    
aaa authentication http console RADIUS LOCAL
aaa authentication enable console RADIUS LOCAL
aaa authentication ssh console RADIUS LOCAL
aaa authentication serial console LOCAL
http server enable 8080
http server idle-timeout 25
http 10.100.0.0 255.255.0.0 inside
snmp-server host inside 10.100.6.21 community ***** version 2c
snmp-server host inside 10.100.6.25 poll community ***** version 2c
snmp-server host inside 10.100.5.114 community ***** version 2c
snmp-server host inside 10.100.5.40 poll community ***** version 2c
snmp-server host inside 10.100.6.56 trap community ***** version 2c
snmp-server host inside 10.100.95.50 poll community ***** version 2c
no snmp-server location
no snmp-server contact
snmp-server community *****
snmp-server enable traps snmp authentication linkup linkdown coldstart
snmp-server enable traps syslog
snmp-server enable traps ipsec start stop
snmp-server enable traps entity config-change
snmp-server enable traps remote-access session-threshold-exceeded
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto ca trustpoint ASDM_TrustPoint0
 enrollment self
 subject-name CN=CH-IT-FW1
 ip-address 72.71.247.96
 crl configure
crypto ca trustpoint ASDM_TrustPoint1
 enrollment self
 fqdn vpn3.nashuanh.gov
 subject-name CN=vpn3.nashuanh.gov
 proxy-ldc-issuer
 crl configure
crypto ca certificate chain ASDM_TrustPoint0
 certificate 0419fd4c
    30820221 3082018a a0030201 02020404 19fd4c30 0d06092a 864886f7 0d010105
    05003055 31123010 06035504 03130943 482d4954 2d465731 313f3019 06092a86
    4886f70d 01090813 0c37322e 37312e32 34372e39 36302206 092a8648 86f70d01
    09021615 43482d49 542d4657 312e6e61 73687561 2e636974 79301e17 0d313030
    38313132 32323634 325a170d 32303038 30383232 32363432 5a305531 12301006
    03550403 13094348 2d49542d 46573131 3f301906 092a8648 86f70d01 0908130c
    37322e37 312e3234 372e3936 30220609 2a864886 f70d0109 02161543 482d4954
    2d465731 2e6e6173 6875612e 63697479 30819f30 0d06092a 864886f7 0d010101
    05000381 8d003081 89028181 008aeecc e0ed25b7 e7bef20c 9afb9111 42473721
    a35db08f 60d09135 ad351a6a 2a7c1ce0 f753fb8d 9207faa2 b193a598 9be776e6
    62333f5e 1a02399c 80632c5d b5d79baa 526043d1 be707901 0fa24349 2e724242
    2c416ee6 b1c79ca3 7f465a44 53bbc647 ba9f1abb f0e130a4 8d2df299 c2e00aa7
    863eb22a 54413c41 c9895144 03020301 0001300d 06092a86 4886f70d 01010505
    00038181 0089bb22 ffbdfa7b 51be6b9f 31ad2964 7c091ac7 8de42f1a 45dd0728
    a2b7182a 01c6675b 6697f11d 4e66ff69 f3793a81 35a8e037 003e7f40 763be233
    d811a421 315c0102 5911fc93 d4e0a206 73b4f6b4 3d695c93 251c114c 8aa4033c
    3426de26 964a0ffb 39f9d99b 96b1d3bb ae0cc570 0d9cc1e9 3730e767 081ba2db
    64066dad e4
  quit
crypto ca certificate chain ASDM_TrustPoint1
 certificate 7bcdc94f
    30820258 308201c1 a0030201 0202047b cdc94f30 0d06092a 864886f7 0d010105
    0500303e 311a3018 06035504 03131176 706e332e 6e617368 75616e68 2e676f76
    3120301e 06092a86 4886f70d 01090216 1176706e 332e6e61 73687561 6e682e67
    6f76301e 170d3134 31303231 31373532 34325a17 0d323431 30313831 37353234
    325a303e 311a3018 06035504 03131176 706e332e 6e617368 75616e68 2e676f76
    3120301e 06092a86 4886f70d 01090216 1176706e 332e6e61 73687561 6e682e67
    6f763081 9f300d06 092a8648 86f70d01 01010500 03818d00 30818902 8181008a
    eecce0ed 25b7e7be f20c9afb 91114247 3721a35d b08f60d0 9135ad35 1a6a2a7c
    1ce0f753 fb8d9207 faa2b193 a5989be7 76e66233 3f5e1a02 399c8063 2c5db5d7
    9baa5260 43d1be70 79010fa2 43492e72 42422c41 6ee6b1c7 9ca37f46 5a4453bb
    c647ba9f 1abbf0e1 30a48d2d f299c2e0 0aa7863e b22a5441 3c41c989 51440302
    03010001 a3633061 300f0603 551d1301 01ff0405 30030101 ff300e06 03551d0f
    0101ff04 04030201 86301f06 03551d23 04183016 8014df69 7d524d1f bb6a4746
    767b20a8 05f3bcc1 f763301d 0603551d 0e041604 14df697d 524d1fbb 6a474676
    7b20a805 f3bcc1f7 63300d06 092a8648 86f70d01 01050500 03818100 4beb2491
    0d0a919e e917976b a15dfea0 7c9edeab 7b2c5baf 8bc7b318 2980c377 c757e58e
    a8f6db4d 198574d4 550d18b5 4d31e8e7 a3531a90 5b71a10b cfbadd1b 190ec74c
    2954e405 6ff8fd78 ce5ff96b a0e7f6b7 1c4f5388 7f298c08 0bf8eafd 004711e0
    09b1dade 5c777f91 41bf3e3d 25a24bb7 c042dbe4 af9bd00d 5ea4aadd
  quit
crypto isakmp enable outside_interface
no crypto isakmp nat-traversal
no vpn-addr-assign dhcp
telnet timeout 30
ssh scopy enable
ssh 10.100.0.0 255.255.0.0 inside
ssh timeout 25
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 10.100.2.253
ssl trust-point ASDM_TrustPoint0
ssl trust-point ASDM_TrustPoint1 outside_interface
webvpn
 port 8484
 enable outside_interface
 dtls port 8484
 svc image disk0:/anyconnect-dart-win-2.5.6005-k9.pkg 2
 svc image disk0:/anyconnect-macosx-i386-2.5.6005-k9.pkg 3
 svc enable
 tunnel-group-list enable
group-policy DfltGrpPolicy attributes
 vpn-simultaneous-logins 2
 vpn-tunnel-protocol l2tp-ipsec
 ip-comp enable
group-policy AVC-GP internal
group-policy AVC-GP attributes
 banner none
 dns-server value 10.100.5.3 10.100.5.2
 vpn-idle-timeout 900
 vpn-session-timeout none
 vpn-tunnel-protocol svc webvpn
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value split_tunnel
 default-domain value nashua.gov
 address-pools value ssl_vpn_pool_new
group-policy IT internal
group-policy IT attributes
 dns-server value 10.100.5.2 10.100.5.5
 vpn-tunnel-protocol svc webvpn
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value split_tunnel
 default-domain value nashua.city
username brittonk password cY962asfNCp6rDsG encrypted
username brittonk attributes
 vpn-group-policy IT
 service-type remote-access
username fradettem password uGR42knFCfLT95.A encrypted
username fradettem attributes
 vpn-group-policy IT
 service-type remote-access
username admin password 90nATqa6nCj5iJ88 encrypted privilege 15
tunnel-group DefaultWEBVPNGroup general-attributes
 address-pool ssl_vpn_pool
tunnel-group DefaultWEBVPNGroup webvpn-attributes
 group-alias default disable
tunnel-group AVC-CP type remote-access
tunnel-group AVC-CP general-attributes
 address-pool ssl_vpn_pool_new
 authentication-server-group AVC-LDAP-SG
 default-group-policy AVC-GP
tunnel-group AVC-CP webvpn-attributes
 radius-reject-message
 group-alias AVG-CP enable
tunnel-group IT type remote-access
tunnel-group IT general-attributes
 address-pool ssl_vpn_pool_new
 default-group-policy IT
tunnel-group IT webvpn-attributes
 group-alias other enable
!
class-map throttle
 match access-list throttle
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect sip  
  inspect netbios
  inspect tftp
  inspect ip-options
policy-map throttle-policy
 class throttle
  police input 10000000 5000
  police output 10000000 5000
!
service-policy global_policy global
service-policy throttle-policy interface outside_interface
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:39ac0895f9baa4a0c62386620eec5eac
: end
CH-IT-FW1#                        

Labels:
0 Helpful
1 Reply 1

lpassmore
Level 1
Level 1

‎03-27-2017 07:54 PM

It might not be related but I had this same situation a while ago if the real IP address of the client device was also in network 10.x.x.x

If so, I think there is a client-side configuration which says to tunnel all traffic

Check the routing table on the PC and try a tracert to see if the traffic even attempts to go down the VPN tunnel

0 Helpful
Customers Also Viewed These Support Documents