ā10-09-2024 11:28 AM
Hi,
I have configured two ISPs (WAN1, WAN2). VPN with anyconnect was already working for both ISPs. Today when doing final tests, VPN for ISP1 on WAN1 is not working anymore. ISP2 on WAN2 still works.
ASA log shows:
1 Starting SSL handshake with client WAN1: 10.10.10.10/50083 to 10.10.10.6/443 for TLS session
2 Device selects trust-point ASDM_TrustPoint1 for client WAN1: 10.10.10.10/50083 to 10.10.10.6/443
3 Device completed SSL handshake with client WAN1: 10.10.10.10/50083 to 10.10.10.6/443 for TLSv1.3 session
4 SSL session with client WAN1: 10.10.10.10/50083 to 10.10.10.6/443 terminated
5 Teardown TCP connection 9360 for WAN1: 10.10.10.10/50083 to identity: 10.10.10.6/443 duration 0:00:00 bytes 3906 TCP Reset-O from identity
6 Deny TCP (no connection) from 10.10.10.10/50083 to 10.10.10.6/443 flags FIN ACK on interface WAN1
I don't have a clue what the issue could be.
Solved! Go to Solution.
ā10-10-2024 02:07 PM
We have found the cause in cooperation with Cisco TAC.
We needed to configure a group URL in the tunnel group profile, i. e. vpn1.domain.com/TunnelGroupName
It's unclear why this group URL is not needed for the configured backup server in the anyconnect XML. The second vpn connection was still working but not the primary one.
ā10-09-2024 01:45 PM
what model of ASA and what Code running on that. is the ASA behind NAT for teh VPN ?
how are you load-balancing the VPN connection over DNS ?
check some configuration reference ( Also provide the config you have, removing confidential information)
ā10-09-2024 01:52 PM
It's a Secure Firewall 3105 running ASA. Version is 9.20(3)4. ASA is located behind both ISP routers.
There is no load balacing. ISP1 is used for VPN primary. If ISP1 fails and ASA switches to ISP2 with it's default route we connect to that WAN ip address. There are two a-records in dns for each ISP (like VPN1.domain, VPN2.domain). Anyconnect has VPN2 specified as backup server.
It's weird because everything was working. I don't know what changes could have caused it. Previously we had running 9.20(3).
ā10-09-2024 03:33 PM
I have downgraded to 9.20(3) but the issue still exists.
ā10-09-2024 09:33 PM
Hi'
Do packet capture in both WAN interface'
Use IP of anyconnect PC (real IP not IP assign from vpn pool) in your capture.
I think you have asymmetric traffic that lead to make tcp teardown.
MHM
ā10-09-2024 11:16 PM
What/how do I have to do?
Packet tracer was fine but maybe not precisely enough.
ā10-09-2024 11:29 PM
Not packet tracer' but capture
If the traffic is asymmetric then it will drop.
MHM
ā10-09-2024 11:36 PM
I will capture it later and come back.
I tought about asymetric routing but don't know where that should happen.
ā10-10-2024 12:00 AM
Post high level diagram to have look.,
how does the ASA know the ISP1 Failed and failover required to other ISP2 ?
ISP Router managed by you ?
can you post the configuration. also refer the document which i have posted.
how does the DNS works ? round robin ?
ā10-10-2024 02:07 PM
We have found the cause in cooperation with Cisco TAC.
We needed to configure a group URL in the tunnel group profile, i. e. vpn1.domain.com/TunnelGroupName
It's unclear why this group URL is not needed for the configured backup server in the anyconnect XML. The second vpn connection was still working but not the primary one.
ā10-11-2024 12:52 AM
Sorry can you more elaborate about TAC suggestion
Thanka a lot
MHM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide