Certain LAN IP addresses inaccessible over AnyConnect VPN

[sstaylor1]

On our network, there are certain IP addresses that, while accessible by users locally, are not accessible to users when they are connected via VPN.  These IP address are part of the same sub-net, 192.168.0.x/24, which is included in the split-tunnel ACL.  We recently replaced Domain Controllers, including the DNS service, but DNS resolution is not an issue for these IPs internally.  ASA and VPN DNS settings were updated with the new DNS IP addresses.

Is it possible that these IPs are being excluded by a WAN-specific AC, which does not effect the LAN side of the network?

Our configuration is an ASA 5512-X, Software Version 9.2(2)4, Device Manager Version 7.3(1)101, AnyConnect 4.6.03049.

[Rob Ingram]

Hi,
Do you have a VPN Filter configured on the ASA that could be restricting access to certain IP addresses or ports?
Do the devices you cannot access have a local firewall enabled that could be restricting access from the Remote Access VPN subnet?

[sstaylor1 · Accepted solution]

RJI,

Thanks for your reply.  You got me thinking, so I checked the NIC configuration on one of the servers that is hosting some of the IPs.  It turns out that, on one of the NICs, the Default Gateway had not been set.  Once I made that change for the NIC, things started working as desired.  Lesson learned.