Hi Expert,
I have configured cisco ASA 5516anyconnect ssl vpn and it is able to access internal network, The problem is the ssl vpn client is unable to access the inside interface of the ASA for management purpose (ssh/http).
Even though the following configuration is in place.
1. The inside interface subnet is mentioned in the split-tunnel acl.
2. The traffic from vpn client to the inside interface is allowed for http/ssh using ACL applied on outside interface.
3. (Management-access inside) command is applied
4. ssh <vpn client subnet> inside AND http <vpn client subnet> inside is applied in ASA.
5. The nat configuration ( nat (any,outside) source static any any destination static <vpn-subnet> <vpn-subnet> no-proxy-arp route-lookup) is applied
Could any one please suggest if anything is missing in my configuration , which could allow vpn client to access the ssh/http of inside ASA interface .
Below is the configuration :
int gi0/0
nameif inside
sec 100
ip add 10.6.1.1 255.255.255.0
int gi0/1
nameif outside
sec 0
ip add 88.88.88.1 255.255.255.249
route outside 0.0.0.0 0.0.0.0 88.88.88.2
route outside 10.10.1.0 255.255.255.0 88.88.88.2
http server enable
http 17.16.1.0 255.255.255.0 inside
http 17.16.11.0 255.255.255.0 inside
http 10.10.1.0 255.255.255.0 inside
ssh 17.16.1.0 255.255.255.0 inside
ssh 17.16.11.0 255.255.255.0 inside
ssh 10.10.1.0 255.255.255.0 inside
management-access inside
object network 10.10.1.0
subnet 10.10.1.0 255.255.255.0
ip local pool VPN_Pool 10.10.1.1-10.10.1.200 mask 255.255.255.0
access-list VPN_Split_tunnel extended permit ip object-group ALL_Network object 10.10.1.0
access-list VPN_Split_tunnel extended permit tcp host 10.6.1.1 object 10.10.1.0
access-list outside_access_in extended permit tcp object VPN_Pool host 10.6.1.1 eq 443
access-list outside_access_in extended permit tcp object VPN_Pool host 10.6.1.1 eq 22
access-list outside_access_in extended permit ip object VPN_Pool object-group All_Network
access-group outside_access_in in interface outside
access-list DAP_Network_access_in extended permit tcp object VPN_Pool host 10.6.1.1 eq 443
access-list DAP_Network_access_in extended permit tcp object VPN_Pool host 10.6.1.1 eq 22
access-list DAP_Network_access_in extended permit ip object VPN_Pool object-group All_Network
username user1 password $sha512$5000$S4ViGn84NVQ==77k2n9HlE7Rig==pbkdf2
username user1 attributes
vpn-simultaneous-logins 1
vpn-framed-ip-address 10.10.1.1 255.255.255.0
service-type remote-access
dynamic-access-policy-record DAP_Network_Mgmt
description "Network Team"
network-acl DAP_Network_access_in
priority 40
webvpn
enable outside
anyconnect image disk0:/anyconnect-win-4.6.00362-webdeploy-k9.pkg 4
anyconnect image disk0:/anyconnect-macos-4.6.00362-webdeploy-k9.pkg 5
anyconnect enable
tunnel-group-list enable
cache
disable
error-recovery disable
group-policy Anyconnect internal
group-policy Anyconnect attributes
banner value Warning!
banner value This is a private system. Unauthorized access to or use of this system is strictly prohibited. By continuing, you acknowledge your awareness of and concurrence with the Logical Access Control Policy of GOC. All Access will be logged. Unauthorized access and illegal use of this system will be subject to criminal prosecution under the law and are subject to disciplinary action.
banner value Warning!
wins-server none
dns-server value 10.11.11.11 10.11.11.12
vpn-simultaneous-logins 1
vpn-idle-timeout 720
vpn-session-timeout 1440
vpn-tunnel-protocol ikev2 ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value VPN_Split_tunnel
default-domain value goc.gov.qa
webvpn
anyconnect profiles value AnyConnect_client_profile type user
tunnel-group Anyconnect type remote-access
tunnel-group Anyconnect general-attributes
address-pool VPN_Pool
default-group-policy Anyconnect
tunnel-group Anyconnect webvpn-attributes
group-alias Anyconnect enable
crypto ipsec ikev2 ipsec SSLVPN
protocol esp encryption aes-256
protocol esp integrity sha-256
cyrpto dynamic-map DMAP 10 set ikev2 ipsec SSLVPN
crypto dynamic-map DMAP 10 set reverse-route
crypto map MAP 100 ipsec dynamic DMAP
crypto map MAP interface outside
crypto ikev2 enable outside client port 443
crypto ikev2 remote trustpoint SSLVPN-TP
nat (any,outside) source static any any destination static 10.10.1.0 10.10.1.0 no-proxy-arp route-lookup
---------------------------------------------------------------
traffic log while trying for ssh (22)
<163>%ASA-3-710003: TCP access denied by ACL from 10.10.1.1/1144 to outside:10.6.1.1.1/22
<166>%ASA-6-110002: Failed to locate egress interface for TCP from outside:10.10.1.1/1144 to 10.6.1.1/22
traffic log while trying for ssh (443)
<166>%ASA-6-106102: access-list DAP_Network_Mgmt permitted tcp for user 'user1' outside/10.10.1.1(1160) -> identity/10.6.1.1(443) hit-cnt 1 first hit [0x7dcb3524, 0xe93914dd]
<166>%ASA-6-110002: Failed to locate egress interface for TCP from outside:10.10.1.1/1160 to 10.6.1.1/443
