cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
239
Views
0
Helpful
1
Replies

ASA 5512-x Anyconnect partially working

nathan demers
Beginner
Beginner

Here is the issue.

Anyconnect connects and functions as intended for the split tunnel with a destination of 192.168.166.0/24  It does not work for 192.168.55.4 /30.  The configuration is the same for both.  I have static no nat statements and interesting traffic ACLs assigned.  There is a little bit of extra code in here due to me playing with this to get it to work.  I have not rebooted this yet because it is in production.  I just need a sanity check because everything is identical for the two subnets. I want to be able to reach the Inside interface and the Inside-166 interfaces.  This will prepare me for expanding access via anyconnect to additional resources internally.

 

SSL-Anyconnect

Working - 192.168.166.0/24

Broken - 192.168.55.4 /30

 


: Hardware:   ASA5512, 4096 MB RAM, CPU Clarkdale 2793 MHz, 1 CPU (2 cores)
:
ASA Version 9.4(1) 
!
hostname examplecom-ASA
domain-name examplecom911.com
enable password KKZEMuUIl6k9bTx9 encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
names
ip local pool SSLClientPool 192.168.201.1-192.168.201.50 mask 255.255.255.0
!
interface GigabitEthernet0/0
 description Global Internet for all devices - Minus 166
 nameif Outside-Internet
 security-level 0
 ip address 192.168.55.2 255.255.255.252 
!
interface GigabitEthernet0/1
 description DIA to Internet for 192.168.166.0/24
 nameif Outside-166
 security-level 0
 ip address dhcp setroute 
!
interface GigabitEthernet0/2
 description Subnet for Internet Access for 911 Call responders
 nameif Inside-166
 security-level 100
 ip address 192.168.166.1 255.255.255.0 
 policy-route route-map RM_166_INTERNET
!
interface GigabitEthernet0/3
 description Internal Global Network for all devices.
 nameif Inside
 security-level 100
 ip address 192.168.55.5 255.255.255.252 
!
interface GigabitEthernet0/4
 shutdown     
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 management-only
 nameif MGMT
 security-level 0
 ip address 192.168.174.250 255.255.255.0 
!
boot system disk0:/asa941-smp-k8.bin
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns server-group DefaultDNS
 domain-name examplecom911.com
same-security-traffic permit inter-interface
object network PAT_166
 subnet 192.168.166.0 255.255.255.0
object network ANYCONNECT_201
 subnet 192.168.201.0 255.255.255.0
object network NETWORK_OBJ_192.168.201.0_26
 subnet 192.168.201.0 255.255.255.0
object-group network 166-SUBNET
 network-object 192.168.166.0 255.255.255.0
object-group network NO_NAT_ANYCONNECT
 network-object 192.168.201.0 255.255.255.0
object-group network NO_NAT_ADMIN
 network-object 192.168.174.0 255.255.255.0
object-group network NO_NAT_VPN_166
 network-object 192.168.166.0 255.255.255.0
access-list PBR_166_INTERNET standard permit 192.168.166.0 255.255.255.0 
access-list PBR_DEFAULT_TRAFFIC standard permit any4 
access-list 166_PUBLIC_IN extended permit ip 192.168.201.0 255.255.255.0 192.168.166.0 255.255.255.0 log 
access-list 166_PUBLIC_IN extended permit ip 192.168.201.0 255.255.255.0 192.168.55.4 255.255.255.252 log 
access-list INSIDE-166-ACL extended permit ip any any 
access-list INSIDE-IN extended permit ip any any 
access-list split-tunnel standard permit 192.168.166.0 255.255.255.0 
access-list split-tunnel standard permit 192.168.174.0 255.255.255.0 
access-list split-tunnel standard permit 192.168.55.4 255.255.255.252 
pager lines 24
logging enable
logging timestamp
logging buffer-size 1000000
logging monitor debugging
logging buffered debugging
logging trap informational
logging asdm informational
logging debug-trace
mtu Outside-Internet 1500
mtu Outside-166 1500
mtu Inside-166 1500
mtu Inside 1500
mtu MGMT 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-741.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (Inside-166,Outside-166) source dynamic any interface
nat (Inside-166,Outside-166) source static any any destination static NETWORK_OBJ_192.168.201.0_26 NETWORK_OBJ_192.168.201.0_26 no-proxy-arp route-lookup
nat (Inside,Outside-166) source static any any destination static NETWORK_OBJ_192.168.201.0_26 NETWORK_OBJ_192.168.201.0_26 no-proxy-arp route-lookup
access-group 166_PUBLIC_IN in interface Outside-166
access-group INSIDE-IN in interface Inside
!
route-map RM_166_INTERNET permit 10
 match ip address PBR_166_INTERNET
 set interface Outside-166

!
router eigrp 1
 network 192.168.166.0 255.255.255.0
 network 192.168.55.4 255.255.255.252
!
route Outside-166 0.0.0.0 0.0.0.0 9.9.9.1 1
route MGMT 192.168.174.0 255.255.255.0 192.168.174.2 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL 
http server enable
http 192.168.174.0 255.255.255.0 MGMT
http 67.161.108.98 255.255.255.255 Outside-166
no snmp-server location
no snmp-server contact
crypto ipsec ikev1 transform-set TS_ESP_3DES_SHA esp-3des esp-sha-hmac 
crypto ipsec ikev1 transform-set TS_ESP_3DES_MD5 esp-3des esp-md5-hmac 
crypto ipsec ikev1 transform-set TS_ESP_AES-256_SHA esp-aes-256 esp-sha-hmac 
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0
 enrollment self
 fqdn none
 subject-name CN=192.168.174.250,CN=examplecom-ASA
 keypair ASDM_LAUNCHER
 crl configure
crypto ca trustpoint localtrust
 enrollment self
 fqdn sslvpn.examplecom911.info
 subject-name CN=sslvpn.examplecom911.info
 keypair sslvpnkey
 crl configure
crypto ca trustpool policy
crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_0
--omitted--

crypto ikev1 policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 28800
crypto ikev1 policy 20
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 28800
crypto ikev1 policy 30
 authentication pre-share
 encryption aes-256
 hash sha
 group 5
 lifetime 28800
telnet timeout 5
ssh stricthostkeycheck

ssh timeout 60
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
management-access Inside-166
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 192.168.174.9 source MGMT prefer
ssl trust-point localtrust Outside-166
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 MGMT
ssl trust-point ASDM_Launcher_Access_TrustPoint_0 MGMT vpnlb-ip
webvpn
 enable Outside-166
 anyconnect image disk0:/anyconnect-win-3.1.10010-k9.pkg 1
 anyconnect enable
 tunnel-group-list enable
 error-recovery disable
group-policy SSLCLient internal
group-policy SSLCLient attributes
 banner value ****************************
 banner value Authorized exampleCom Admins Only
 banner value ****************************
 dns-server value 9.9.9.1 4.4.2.2
 vpn-tunnel-protocol ssl-client 
 re-xauth enable
 pfs enable
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value split-tunnel
 default-domain value examplecom911.info
 address-pools value SSLClientPool
group-policy GroupPolicy_exampleCOM_ANYCONNECT internal
group-policy GroupPolicy_exampleCOM_ANYCONNECT attributes
 wins-server none
 dns-server value 9.9.9.1 4.4.2.2
 vpn-tunnel-protocol ssl-client 
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value split-tunnel
 default-domain value examplecom911.com
 split-tunnel-all-dns disable
dynamic-access-policy-record DfltAccessPolicy
username example_brad password Fk3MzOeAau1lt.2O encrypted
username example_brad attributes
 service-type remote-access
username examplecom password KF.aA.oQrkSpW2BY encrypted
username example_josh password .PZSPsFZj/qTuAND encrypted
username example_josh attributes
 service-type remote-access
username example_jerry password KF.aA.oQrkSpW2BY encrypted
username example_jerry attributes
 service-type remote-access
tunnel-group SSLClient type remote-access
tunnel-group SSLClient general-attributes
 default-group-policy SSLCLient
tunnel-group SSLClient webvpn-attributes
 group-alias exampleCom-Admins enable

class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect ip-options 
  inspect netbios 
  inspect rsh 
  inspect rtsp 
  inspect skinny  
  inspect esmtp 
  inspect sqlnet 
  inspect sunrpc 
  inspect tftp 
  inspect sip  
  inspect xdmcp 
  inspect icmp 
!
service-policy global_policy global
prompt hostname context 
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly 5
  subscribe-to-alert-group configuration periodic monthly 5
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:cc456cfabf1392fc7fefec51737a9a30
: end

1 Reply 1

nathan demers
Beginner
Beginner

Wanted to follow up on the solution.

The issue is the following: management-access Inside-166

That command allows me access the 192.168.166.1 address for management purposes but the 55.5 address is not accessible.  If I change the management access command to Inside instead of Inside-166 then the 55.5 address is available for icmp.  Once I setup ospf on the opposite side of the 55.x then I could reah the opposing side but could not manage the 55.5 still.  

So Anyconnect was not broken just giving a false representation of broken based on ignorance.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: