Anyconnect with asa 5505 stopped working (local access)

Icharus83 · ‎09-27-2012

Hello,

i was installing a IIS server to our client and created access - rules for http server and port translations.

After that i noticed i lost local lan access trough vpn. Anyconnect and ipsec vpn. No other changes made to asa than those access-rules and nat changes.

I'm trying to find out what is wrong, vpn connects okay, i can ping ASA but nothing else on inside network (for example dns server). Dns is not either working.

When i ping local server, i can see in log:

6

Sep 27 2012

12:59:34

192.168.100.240

61139

192.168.100.2

53

Built inbound UDP connection 20995 for outside:192.168.100.240/61139 (192.168.100.240/61139)(LOCAL\administrator) to inside:192.168.100.2/53 (192.168.100.2/53) (administrator)

6

Sep 27 2012

12:59:35

192.168.100.240

1

192.168.100.2

0

Teardown ICMP connection for faddr 192.168.100.240/1(LOCAL\administrator) gaddr 192.168.100.2/0 laddr 192.168.100.2/0 (administrator)

On client machine, i see only request timed out. What could cause this problem? It has been working very good for last ten months...

Asa 8,43

Here is my configuration

Result of the command: "sh running-conf"

: Saved

:

ASA Version 8.4(3)

!

hostname XXXAsa

domain-name XXX.local

enable password

passwd

multicast-routing

names

name XXX.XXX.XXX.161 ulkoip description gw

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

ip address 192.168.100.1 255.255.255.0

ospf cost 10

!

boot system disk0:/asa843-k8.bin

ftp mode passive

clock timezone EEST 2

clock summer-time EEDT recurring last Sun Mar 3:00 last Sun Oct 4:00

dns server-group DefaultDNS

domain-name XXX.local

object network obj-192.168.100.0

subnet 192.168.100.0 255.255.255.0

object network obj-192.168.1.0

subnet 192.168.1.0 255.255.255.0

object network obj_any-01

subnet 0.0.0.0 0.0.0.0

object network obj_any-02

subnet 0.0.0.0 0.0.0.0

object network obj-0.0.0.0

host 0.0.0.0

object network obj_any-03

subnet 0.0.0.0 0.0.0.0

object network obj_any-04

subnet 0.0.0.0 0.0.0.0

object network PORTFORWARD-TCP80

host 192.168.100.2

object-group network obj_any

access-list inside_nat0_outbound extended permit ip 192.168.100.0 255.255.255.0 192.168.100.0 255.255.255.0

access-list Sisaverkko standard permit 192.168.100.0 255.255.255.0

access-list tunneliryhma_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0

access-list inside_access_out extended permit ip any any

access-list inside_access_out remark Allow VPN CLients

access-list inside_access_out extended permit ip object obj-192.168.100.0 any

access-list inside_test extended permit icmp any host 192.168.100.2

access-list Outside_In extended permit icmp any any unreachable

access-list Outside_In extended permit icmp any any time-exceeded

access-list Outside_In extended permit icmp any any echo-reply

access-list Outside_In extended permit tcp any host 192.168.100.2 eq www

access-list global_access extended permit ip any any

access-list inside_access_in remark Allow VPN CLients

access-list inside_access_in extended permit ip object obj-192.168.100.0 any

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

mtu dmz 1500

ip local pool VPNpooli2 192.168.100.20-192.168.100.29 mask 255.255.255.255

ip local pool VPNPoolSSL 192.168.100.240-192.168.100.250 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

icmp permit any inside

asdm image disk0:/asdm-647.bin

no asdm history enable

arp timeout 14400

nat (inside,outside) source static obj-192.168.100.0 obj-192.168.100.0 destination static obj-192.168.100.0 obj-192.168.100.0 no-proxy-arp

!

nat (inside,outside) after-auto source dynamic any interface

access-group inside_access_in in interface inside

access-group global_access global

route outside 0.0.0.0 0.0.0.0 ulkoip 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server my_authent_grp protocol kerberos

aaa-server my_authent_grp (inside) host 192.168.100.2

kerberos-realm XXX.LOCAL

aaa-server my_author_grp protocol ldap

aaa-server my_author_grp (inside) host 192.168.100.2

ldap-base-dn ou=XXX

ldap-naming-attribute uid

server-type auto-detect

user-identity default-domain LOCAL

url-cache dst 10

http server enable

http 192.168.100.0 255.255.255.0 inside

http YYY.YYY.YYY.YYY 255.255.255.255 outside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

sysopt noproxyarp inside

crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto dynamic-map outside_dyn_map 20 set pfs

crypto dynamic-map outside_dyn_map 20 set ikev1 transform-set ESP-3DES-SHA

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map interface outside

crypto ca trustpoint _SmartCallHome_ServerCA

crl configure

crypto ca trustpoint self

enrollment self

subject-name CN=XXX.XXX.XXX.162,CN=vpn.XXX.fi

crl configure

crypto ca certificate chain _SmartCallHome_ServerCA

certificate ca 6ecc7aa5a7032009b8cebcf4e952d491

308205ec 308204d4 a0030201 0202106e cc7aa5a7 032009b8 cebcf4e9 52d49130

0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117

30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b

13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504

0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72

20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56

65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043

65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31

30303230 38303030 3030305a 170d3230 30323037 32333539 35395a30 81b5310b

30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20

496e632e 311f301d 06035504 0b131656 65726953 69676e20 54727573 74204e65

74776f72 6b313b30 39060355 040b1332 5465726d 73206f66 20757365 20617420

68747470 733a2f2f 7777772e 76657269 7369676e 2e636f6d 2f727061 20286329

3130312f 302d0603 55040313 26566572 69536967 6e20436c 61737320 33205365

63757265 20536572 76657220 4341202d 20473330 82012230 0d06092a 864886f7

0d010101 05000382 010f0030 82010a02 82010100 b187841f c20c45f5 bcab2597

a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10

9c688b2e 957b899b 13cae234 34c1f35b f3497b62 83488174 d188786c 0253f9bc

7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b

15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845

63cd1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8

18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced

4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f

81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 02030100 01a38201 df308201

quit

no crypto isakmp nat-traversal

crypto ikev1 enable outside

crypto ikev1 policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh timeout 5

console timeout 0

management-access inside

dhcpd domain XXX

!

dhcpd address 192.168.100.30-192.168.100.199 inside

dhcpd dns 192.168.100.2 interface inside

dhcpd wins 192.168.100.2 interface inside

dhcpd lease 432000 interface inside

dhcpd ping_timeout 2000 interface inside

dhcpd domain XXX.local interface inside

dhcpd enable inside

!

threat-detection basic-threat

threat-detection statistics host

threat-detection statistics port

threat-detection statistics protocol

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ntp server 62.121.60.58 source outside prefer

tftp-server inside 192.168.100.9 /XXXconfi

ssl trust-point self outside

webvpn

enable outside

anyconnect-essentials

anyconnect image disk0:/anyconnect-win-3.0.5080-k9.pkg 1

anyconnect profiles XXXvpn disk0:/AnyConnectProfile.xml

anyconnect enable

tunnel-group-list enable

group-policy DfltGrpPolicy attributes

wins-server value 192.168.100.2

dns-server value 192.168.100.2

vpn-simultaneous-logins 20

vpn-tunnel-protocol ikev1

ipsec-udp enable

default-domain value XXX.local

user-authentication-idle-timeout 10

group-policy GroupPolicy_XXXSSLVPN internal

group-policy GroupPolicy_XXXSSLVPN attributes

dns-server value 192.168.100.2

vpn-idle-timeout 120

vpn-tunnel-protocol ssl-client

split-tunnel-policy tunnelspecified

split-tunnel-network-list value Sisaverkko

default-domain value XXX.LOCAL

webvpn

anyconnect profiles value XXXvpn type user

customization value DfltCustomazation

always-on-vpn profile-setting

group-policy XXXVPN internal

group-policy XXXVPN attributes

vpn-tunnel-protocol ikev1

split-tunnel-policy tunnelspecified

split-tunnel-network-list value Sisaverkko

address-pools value VPNpooli2

username xxx password encrypted

username xxx attributes

vpn-group-policy XXXVPN

service-type remote-access

tunnel-group DefaultRAGroup webvpn-attributes

customization DfltCustomazation

tunnel-group DefaultWEBVPNGroup webvpn-attributes

customization DfltCustomazation

tunnel-group XXXVPN type remote-access

tunnel-group XXXVPN general-attributes

address-pool VPNpooli2

default-group-policy XXXVPN

tunnel-group XXXVPN webvpn-attributes

customization DfltCustomazation

tunnel-group XXXVPN ipsec-attributes

ikev1 pre-shared-key *****

isakmp keepalive disable

tunnel-group XXXSSLVPN type remote-access

tunnel-group XXXSSLVPN general-attributes

address-pool VPNPoolSSL

authentication-server-group my_authent_grp

default-group-policy GroupPolicy_XXXSSLVPN

tunnel-group XXXSSLVPN webvpn-attributes

customization DfltCustomazation

group-alias XXXSSLVPN enable

!

class-map inspection_default

match default-inspection-traffic

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 4096

policy-map global_policy

class inspection_default

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect dns preset_dns_map

inspect ip-options

inspect icmp

!

service-policy global_policy global

prompt hostname context

compression anyconnect-ssl

service call-home

no call-home reporting anonymous

call-home

contact-email-addr YYY@XXX.fi

profile CiscoTAC-1

destination address http https://tools.cisco.com/i

destination address email callhome@cisco.com

destination transport-method http

subscribe-to-alert-group diagnostic

subscribe-to-alert-group environment

subscribe-to-alert-group inventory periodic monthly

subscribe-to-alert-group configuration periodic monthly

subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:c7a6c31afe9d01d923ba3a52d594c384

: end