Cisco ASA 8.4 Remote Access VPN - client connects but cannot access inside network

[Ntech.n1ck]

  I am having issues accessing resources on the inside network when connecting with Cisco client VPN to a Cisco ASA 5510 running 8.4(3) version of the IOS with ASDM 6.4. I cannot access the inside network. I can see traffic in the logs when pinging. Please see config below, any suggestions would be appreciated.

Result of the command: "show running-config"

: Saved
:
ASA Version 8.4(1)

!
interface Ethernet0/0
description outside network port
nameif Outside
security-level 0
ip address 
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 10.7.201.254 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup inside
dns server-group DefaultDNS
name-server 10.7.201.5
name-server 10.7.107.5
domain-name Anka.local
object network RadminPOE
host 10.7.201.5
description Radmin Access to GAAD   
object network Sony_Ipella
host 10.7.201.100
description Sony Video Conferencing                 
object network Eastpoint-Subnet
subnet 10.7.201.0 255.255.255.0
object network Hemet-Subnet
subnet 10.50.1.0 255.255.255.0
description Hemet-Subnet                 
object network Hemet-Dial-In-VPN
subnet 10.50.99.0 255.255.255.240
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network Hemet-PUB
host 69.4.181.106
description Hemet Public IP  
object network NETWORK_OBJ_10.7.201.0_24
subnet 10.7.201.0 255.255.255.0
object network NETWORK_OBJ_10.7.212.0_27
subnet 10.7.212.0 255.255.255.224
object network NETWORK_OBJ_10.7.209.0_27
subnet 10.7.209.0 255.255.255.224
object network NETWORK_OBJ_192.168.20.10
host 192.168.20.10
object network NETWORK_OBJ_192.168.1.0_26
subnet 192.168.1.0 255.255.255.192
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
object-group network DM_INLINE_NETWORK_1
network-object object Hemet-Subnet
network-object object Hemet-Dial-In-VPN
network-object object Hemet-PUB
object-group network DM_INLINE_NETWORK_2
network-object object Hemet-Dial-In-VPN
network-object object Hemet-PUB
network-object object Hemet-Subnet
access-list Outside_access_in remark Sony Video Conferencing
access-list Outside_access_in extended permit tcp any object Sony_Ipella
access-list Outside_access_in remark Radmin Access to GAAD
access-list Outside_access_in extended permit object-group TCPUDP any object RadminPOE
access-list Outside_access_in remark Radmin Access to AFSPEPSTAFF1
access-list Outside_cryptomap_4 extended permit ip object Eastpoint-Subnet object-group DM_INLINE_NETWORK_1
access-list global_mpc extended permit ip any any
access-list global_access remark Allow Ping
access-list global_access extended permit icmp any any
access-list inside_access_in remark Allow Internet
access-list inside_access_in extended permit ip any any
access-list Remote-VPN_splitTunnelAcl standard permit 10.7.201.0 255.255.255.0
access-list Remote-VPN_splitTunnelAcl_1 standard permit 10.7.201.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
no logging message 106015
no logging message 313001
no logging message 313008
no logging message 106023
no logging message 710003
no logging message 106100
no logging message 302015
no logging message 302014
no logging message 302013
no logging message 302018
no logging message 302017
no logging message 302016
no logging message 302021
no logging message 302020
flow-export destination Outside 10.7.201.10 2055
mtu Outside 1500
mtu inside 1500
mtu management 1500
ip local pool vpn-pool 192.168.1.30-192.168.1.40 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
no asdm history enable
arp timeout 14400
nat (inside,Outside) source static Eastpoint-Subnet Eastpoint-Subnet destination static DM_INLINE_NETWORK_2 DM_INLINE_NETWORK_2
nat (inside,Outside) source static NETWORK_OBJ_10.7.201.0_24 NETWORK_OBJ_10.7.201.0_24 destination static NETWORK_OBJ_10.7.212.0_27 NETWORK_OBJ_10.7.212.0_27
nat (inside,Outside) source static NETWORK_OBJ_10.7.201.0_24 NETWORK_OBJ_10.7.201.0_24 destination static NETWORK_OBJ_10.7.209.0_27 NETWORK_OBJ_10.7.209.0_27
nat (inside,Outside) source static any any destination static NETWORK_OBJ_192.168.20.10 NETWORK_OBJ_192.168.20.10
nat (inside,Outside) source static any any destination static NETWORK_OBJ_192.168.1.0_26 NETWORK_OBJ_192.168.1.0_26
!
object network RadminPOE
nat (inside,Outside) static *.*.*.* service tcp 2399 2399
object network Sony_Ipella
nat (inside,Outside) static *.*.*.*
object network obj_any
nat (inside,Outside) dynamic interface
!
nat (management,Outside) after-auto source dynamic any interface
access-group Outside_access_in in interface Outside
access-group inside_access_in in interface inside
access-group global_access global
route Outside 0.0.0.0 0.0.0.0 *.*.*.*
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 management
http 0.0.0.0 0.0.0.0 Outside
http 10.7.201.0 255.255.255.0 inside
snmp-server host inside 10.7.201.10 community *****
snmp-server location East point
no snmp-server contact
snmp-server community *****
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
snmp-server enable traps syslog
snmp-server enable traps ipsec start stop
snmp-server enable traps entity config-change
snmp-server enable traps memory-threshold
snmp-server enable traps interface-threshold
snmp-server enable traps connection-limit-reached
snmp-server enable traps cpu threshold rising
snmp-server enable traps nat packet-discard
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map Outside_map 5 match address Outside_cryptomap_4
crypto map Outside_map 5 set pfs
crypto map Outside_map 5 set peer *.*.*.*
crypto map Outside_map 5 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map Outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map Outside_map interface Outside
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5
prf sha
lifetime seconds 86400
crypto ikev1 enable Outside
crypto ikev1 policy 10
authentication crack
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 20
authentication rsa-sig
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 30
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 40
authentication crack
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 50
authentication rsa-sig
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 60
authentication pre-share
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 70
authentication crack
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 80
authentication rsa-sig
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 90
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 100
authentication crack
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 110
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 120
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
management-access inside
dhcpd address 10.7.201.101-10.7.201.200 inside
dhcpd dns 10.7.201.5 10.7.107.8 interface inside
dhcpd domain Anka.local interface inside
dhcpd option 3 ip 10.7.201.252 interface inside
dhcpd enable inside
!
dhcpd address 192.168.1.50-192.168.1.150 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
webvpn
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol ikev1 ssl-clientless
group-policy GroupPolicy_*.*.*.* internal
group-policy GroupPolicy_*.*.*.* attributes
vpn-tunnel-protocol ikev1
group-policy Remote-VPN internal
group-policy Remote-VPN attributes
dns-server value 10.7.201.5 10.7.107.5
vpn-tunnel-protocol ikev1
split-tunnel-policy tunnelall
split-tunnel-network-list none
default-domain value Anka.local
group-policy Anka-vpn internal
group-policy Anka-vpn attributes
dns-server value 10.7.201.5 10.7.107.5
vpn-tunnel-protocol ikev1
username nthompson password jAAznTGHRAqVqLIn encrypted privilege 0
username nthompson attributes
vpn-group-policy Remote-VPN
tunnel-group *.*.*.* type ipsec-l2l
tunnel-group *.*.*.* ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group Anka-vpn type remote-access
tunnel-group Anka-vpn general-attributes
address-pool vpn-pool
default-group-policy Anka-vpn
tunnel-group Anka-vpn ipsec-attributes
ikev1 pre-shared-key *****
!
class-map global-class
match access-list global_mpc
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
description netflow
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny 
  inspect sunrpc
  inspect xdmcp
  inspect sip 
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp
class global-class
  flow-export event-type all destination 10.7.201.10
!
service-policy global_policy global
prompt hostname context
call-home
profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
hpm topN enable
Cryptochecksum:46cac529d1f21b565f6af02982cd5ada
: end

[Jennifer Halim]

Which tunnel-group are you using?

I assume that you are using "Anka-vpn", and it ties into the "Anka-vpn" group-policy, however it doesn't have any split tunnel policy configured. Do you mean to configure split tunnel or tunnelall for this particular vpn?

Also, i would stir away from using the "any" keyword and use subnet specific, so you can change:

from:

nat (inside,Outside) source static any any destination static NETWORK_OBJ_192.168.20.10 NETWORK_OBJ_192.168.20.10

nat (inside,Outside) source static any any destination static NETWORK_OBJ_192.168.1.0_26 NETWORK_OBJ_192.168.1.0_26

to:

nat (inside,Outside) source static Eastpoint-Subnet Eastpoint-Subnet destination static NETWORK_OBJ_192.168.20.10 NETWORK_OBJ_192.168.20.10

nat (inside,Outside) source static Eastpoint-Subnet Eastpoint-Subnet destination static NETWORK_OBJ_192.168.1.0_26 NETWORK_OBJ_192.168.1.0_26

Then "clear xlate" after the above changes.

[Gareth Gudger]

You may need to enable NAT Traversal. Type the following command.

CRYPTO ISAKMP NAT-TRAVERSAL 30

More in depth info here:

http://supertekboy.com/2014/01/28/cisco-vpn-connects-but-cannot-access-inside-resources/