Showing results for 
Search instead for 
Did you mean: 

ASA 5512-x Anyconnect partially working

nathan demers

Here is the issue.

Anyconnect connects and functions as intended for the split tunnel with a destination of  It does not work for /30.  The configuration is the same for both.  I have static no nat statements and interesting traffic ACLs assigned.  There is a little bit of extra code in here due to me playing with this to get it to work.  I have not rebooted this yet because it is in production.  I just need a sanity check because everything is identical for the two subnets. I want to be able to reach the Inside interface and the Inside-166 interfaces.  This will prepare me for expanding access via anyconnect to additional resources internally.



Working -

Broken - /30


: Hardware:   ASA5512, 4096 MB RAM, CPU Clarkdale 2793 MHz, 1 CPU (2 cores)
ASA Version 9.4(1) 
hostname examplecom-ASA
enable password KKZEMuUIl6k9bTx9 encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
ip local pool SSLClientPool mask
interface GigabitEthernet0/0
 description Global Internet for all devices - Minus 166
 nameif Outside-Internet
 security-level 0
 ip address 
interface GigabitEthernet0/1
 description DIA to Internet for
 nameif Outside-166
 security-level 0
 ip address dhcp setroute 
interface GigabitEthernet0/2
 description Subnet for Internet Access for 911 Call responders
 nameif Inside-166
 security-level 100
 ip address 
 policy-route route-map RM_166_INTERNET
interface GigabitEthernet0/3
 description Internal Global Network for all devices.
 nameif Inside
 security-level 100
 ip address 
interface GigabitEthernet0/4
 no nameif
 no security-level
 no ip address
interface GigabitEthernet0/5
 no nameif
 no security-level
 no ip address
interface Management0/0
 nameif MGMT
 security-level 0
 ip address 
boot system disk0:/asa941-smp-k8.bin
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns server-group DefaultDNS
same-security-traffic permit inter-interface
object network PAT_166
object network ANYCONNECT_201
object network NETWORK_OBJ_192.168.201.0_26
object-group network 166-SUBNET
object-group network NO_NAT_ANYCONNECT
object-group network NO_NAT_ADMIN
object-group network NO_NAT_VPN_166
access-list PBR_166_INTERNET standard permit 
access-list PBR_DEFAULT_TRAFFIC standard permit any4 
access-list 166_PUBLIC_IN extended permit ip log 
access-list 166_PUBLIC_IN extended permit ip log 
access-list INSIDE-166-ACL extended permit ip any any 
access-list INSIDE-IN extended permit ip any any 
access-list split-tunnel standard permit 
access-list split-tunnel standard permit 
access-list split-tunnel standard permit 
pager lines 24
logging enable
logging timestamp
logging buffer-size 1000000
logging monitor debugging
logging buffered debugging
logging trap informational
logging asdm informational
logging debug-trace
mtu Outside-Internet 1500
mtu Outside-166 1500
mtu Inside-166 1500
mtu Inside 1500
mtu MGMT 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-741.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (Inside-166,Outside-166) source dynamic any interface
nat (Inside-166,Outside-166) source static any any destination static NETWORK_OBJ_192.168.201.0_26 NETWORK_OBJ_192.168.201.0_26 no-proxy-arp route-lookup
nat (Inside,Outside-166) source static any any destination static NETWORK_OBJ_192.168.201.0_26 NETWORK_OBJ_192.168.201.0_26 no-proxy-arp route-lookup
access-group 166_PUBLIC_IN in interface Outside-166
access-group INSIDE-IN in interface Inside
route-map RM_166_INTERNET permit 10
 match ip address PBR_166_INTERNET
 set interface Outside-166

router eigrp 1
route Outside-166 1
route MGMT 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL 
http server enable
http MGMT
http Outside-166
no snmp-server location
no snmp-server contact
crypto ipsec ikev1 transform-set TS_ESP_3DES_SHA esp-3des esp-sha-hmac 
crypto ipsec ikev1 transform-set TS_ESP_3DES_MD5 esp-3des esp-md5-hmac 
crypto ipsec ikev1 transform-set TS_ESP_AES-256_SHA esp-aes-256 esp-sha-hmac 
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0
 enrollment self
 fqdn none
 subject-name CN=,CN=examplecom-ASA
 crl configure
crypto ca trustpoint localtrust
 enrollment self
 keypair sslvpnkey
 crl configure
crypto ca trustpool policy
crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_0

crypto ikev1 policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 28800
crypto ikev1 policy 20
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 28800
crypto ikev1 policy 30
 authentication pre-share
 encryption aes-256
 hash sha
 group 5
 lifetime 28800
telnet timeout 5
ssh stricthostkeycheck

ssh timeout 60
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
management-access Inside-166
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server source MGMT prefer
ssl trust-point localtrust Outside-166
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 MGMT
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 MGMT vpnlb-ip
 enable Outside-166
 anyconnect image disk0:/anyconnect-win-3.1.10010-k9.pkg 1
 anyconnect enable
 tunnel-group-list enable
 error-recovery disable
group-policy SSLCLient internal
group-policy SSLCLient attributes
 banner value ****************************
 banner value Authorized exampleCom Admins Only
 banner value ****************************
 dns-server value
 vpn-tunnel-protocol ssl-client 
 re-xauth enable
 pfs enable
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value split-tunnel
 default-domain value
 address-pools value SSLClientPool
group-policy GroupPolicy_exampleCOM_ANYCONNECT internal
group-policy GroupPolicy_exampleCOM_ANYCONNECT attributes
 wins-server none
 dns-server value
 vpn-tunnel-protocol ssl-client 
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value split-tunnel
 default-domain value
 split-tunnel-all-dns disable
dynamic-access-policy-record DfltAccessPolicy
username example_brad password Fk3MzOeAau1lt.2O encrypted
username example_brad attributes
 service-type remote-access
username examplecom password KF.aA.oQrkSpW2BY encrypted
username example_josh password .PZSPsFZj/qTuAND encrypted
username example_josh attributes
 service-type remote-access
username example_jerry password KF.aA.oQrkSpW2BY encrypted
username example_jerry attributes
 service-type remote-access
tunnel-group SSLClient type remote-access
tunnel-group SSLClient general-attributes
 default-group-policy SSLCLient
tunnel-group SSLClient webvpn-attributes
 group-alias exampleCom-Admins enable

class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect ip-options 
  inspect netbios 
  inspect rsh 
  inspect rtsp 
  inspect skinny  
  inspect esmtp 
  inspect sqlnet 
  inspect sunrpc 
  inspect tftp 
  inspect sip  
  inspect xdmcp 
  inspect icmp 
service-policy global_policy global
prompt hostname context 
no call-home reporting anonymous
 profile CiscoTAC-1
  no active
  destination address http
  destination address email
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly 5
  subscribe-to-alert-group configuration periodic monthly 5
  subscribe-to-alert-group telemetry periodic daily
: end

1 Reply 1

nathan demers

Wanted to follow up on the solution.

The issue is the following: management-access Inside-166

That command allows me access the address for management purposes but the 55.5 address is not accessible.  If I change the management access command to Inside instead of Inside-166 then the 55.5 address is available for icmp.  Once I setup ospf on the opposite side of the 55.x then I could reah the opposing side but could not manage the 55.5 still.  

So Anyconnect was not broken just giving a false representation of broken based on ignorance.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: