Anyconnect with the multiple Inside interfaces

[peter.jevos]

Hi

I have configured Anyconnect on the Outside interface, and can reach the Inside network. However i cannot reach the other Inside_2 and more inner interfaces on the ASA.
Example:

Interface Name IP address Subnet mask Method
GigabitEthernet0/0 Outside 20.2.173.12 255.255.255.248 CONFIG
GigabitEthernet0/1 Inside 192.168.1.254 255.255.255.0 CONFIG
GigabitEthernet0/2 Inside_2 172.16.1.1 255.255.255.0 CONFIG
GigabitEthernet0/3 Inside_3 192.168.162.0 255.255.255.0 CONFIG

nat (Inside,Outside) source static any any destination static NETWORK_OBJ_Anyconnect NETWORK_OBJ_Anyconnect
nat (Inside_2,Outside) source static any any destination static NETWORK_OBJ_Anyconnect NETWORK_OBJ_Anyconnect  // this does not work

I also tried :

nat (Any,Outside) source static any any destination static NETWORK_OBJ_Anyconnect NETWORK_OBJ_Anyconnect

however i can reach only the address under Inside interface.

Many thanks

[Philip D'Ath]

Have you got a split tunnel configured?

[peter.jevos]

Yes, split tunnel is configured with standard ACL, where all necessary subnets are included

[Philip D'Ath]

Are there any ACL's which might be blocking the traffic?

[mibricen]

Hello Peter,

May you test the no-proxy-arp and route-lookup commands on the nat line.

E.g.

nat (Any,Outside) source static any any destination static NETWORK_OBJ_Anyconnect NETWORK_OBJ_Anyconnect no-proxy-arp route-lookup

For reference:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/I-R/cmdref2/n.html

Route-lookup:

For identity NAT in routed mode, determines the egress interface using a route lookup instead of using the interface specified in the NAT command. If you do not specify interfaces in the NAT command, a route lookup is used by default.

No-proxy-arp:

For static NAT, disables proxy ARP for incoming packets to the mapped IP addresses.

Also may you run a packet tracer command from both interfaces to check if the packet is dropped on the ASA by any reason:

packet-tracer input inside icmp "ip address from local host" 8 0 "ip address from remote host" detailed

packet-tracer input inside2 icmp "ip address from local host" 8 0 "ip address from remote host" detailed

Copy and compare them both checking for any difference.

Miguel

TAC VPN