Anyconnect

[benolyndav]

Hi
I think I asked about this once before but I am not grasping it can somone please explain in laymans terms what this is saying, 

• Whenever IKE ports 500/4500 or SSL port 443 is in use or when there are some PAT translations that are active, the AnyConnect IPSec-IKEv2 or SSL remote access VPN cannot be configured on the same port as it fails to start the service on those ports. These ports must not be used on the Firepower Threat Defense device before configuring Remote Access VPN.

[Rob Ingram]

@benolyndav can you post the link that text is from, in order to provide some further context?.....

...but at a guess I assume this is related to NAT? If you have a static NAT for say tcp/443 using the outside interface, then you cannot enable RAVPN on tcp/443 on the outside interface, as the ASA is already listening on that port for the static NAT. In this scenario you'd need to configure the static NAT on another public IP address and not use the ASA outside interface.

[benolyndav]

Thanks

https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/firepower_threat_defense_remote_access_vpns.html

[Rob Ingram]

@benolyndav the document doesn't further expand on that, but I believe it is referring to my response above. So if the ASA is translating tcp/443 or IPSec ports udp/500 udp/4500 behind it's outside interface then you'd be unable to configure a RAVPN on the outside interface.

[benolyndav]

Hi Rob

Yes the document does need some more info, please see attached at the nat rules and the acls for theses nat rules do allow 443 so would this stop the ravpn,??

regarding  udp/500 udp/4500 we do have nat rules for these but are using nat addresses and not the interface so im assuming that would be ok

[Rob Ingram]

@benolyndav that should be fine.

[benolyndav]

Hi
Is that because its dynamic NAT ??

[Rob Ingram · Accepted solution]

@benolyndav you'd only have the problem if using static PAT behind the outside interface, which you don't appear to be.

[Marvin Rhoads]

Even without static PAT I have seen it sometimes present an issue when trying to add site-to-site VPN to a firewall where there is an existing site-to-site tunnel passing through the firewall and sitting on that udp port.

Not super common but something to check for when the setup fails.

[benolyndav]

Thanks Marvin