Re: Cisco FMC RA VPN Issue - Page 2

Dipak Masurkar · ‎06-26-2023

Cisco FMC 1600 after configuring RA vpn not able to connect, but meanwhile trying S2S vpn it is working properly.

1: 13:20:11.748359 1.1.1.1.648 > 10.10.10.5.137: udp 50
Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
MAC Access list

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 3
Type: ROUTE-LOOKUP
Subtype: No ECMP load balancing
Result: ALLOW
Config:
Additional Information:
Destination is locally connected. No ECMP load balancing.
Found next-hop 10.10.10.5 using egress ifc identity(vrfid:0)

Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: Outside(vrfid:0)
input-status: up
input-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule, Drop-location: frame 0x0000559e326ae1fa flow (NA)/NA

Dipak Masurkar · ‎06-26-2023

While checking as said there no traffic hitting.

Not found any packet for vpn pool to inside subnet

MHM Cisco World · ‎06-26-2023

Share the packet tracer when using vpn pool ip let me see

Dipak Masurkar · ‎06-26-2023

Source IP vpn pool- 10.10.40.1

Destination- internal subnet- 10.44.189.156

find Below tracer

Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x14de241e6760, priority=13, domain=capture, deny=false
hits=295647, user_data=0x14de1f8fab50, cs_id=0x0, l3_type=0x0
src mac=0000.0000.0000, mask=0000.0000.0000
dst mac=0000.0000.0000, mask=0000.0000.0000
input_ifc=Outside, output_ifc=any

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x14de20bf49c0, priority=1, domain=permit, deny=false
hits=156965, user_data=0x0, cs_id=0x0, l3_type=0x8
src mac=0000.0000.0000, mask=0000.0000.0000
dst mac=0000.0000.0000, mask=0100.0000.0000
input_ifc=Outside, output_ifc=any

Phase: 3
Type: INPUT-ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
Found next-hop 10.10.20.2 using egress ifc Inside_Lan(vrfid:0)

Phase: 4
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group CSM_FW_ACL_ global
access-list CSM_FW_ACL_ advanced trust ip any any rule-id 268435464 event-log flow-end
access-list CSM_FW_ACL_ remark rule-id 268435464: PREFILTER POLICY: NGFW_EXT_HA
access-list CSM_FW_ACL_ remark rule-id 268435464: RULE: IN_to_OUT
Additional Information:
Forward Flow based lookup yields rule:
in id=0x14de20c323f0, priority=12, domain=permit, trust
hits=69292, user_data=0x14dd9b5a1d00, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, ifc=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, ifc=any, vlan=0, dscp=0x0, nsg_id=none
input_ifc=any, output_ifc=any

Phase: 5
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
class-map class-default
match any
policy-map global_policy
class class-default
set connection advanced-options UM_STATIC_TCP_MAP
service-policy global_policy global
Additional Information:
Forward Flow based lookup yields rule:
in id=0x14de20fa1110, priority=7, domain=conn-set, deny=false
hits=1504, user_data=0x14de26672d70, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, nsg_id=none
input_ifc=Outside(vrfid:0), output_ifc=any

Phase: 6
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x14ddc6fcedf0, priority=0, domain=nat-per-session, deny=false
hits=11674648, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, nsg_id=none
input_ifc=any, output_ifc=any

Phase: 7
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x14de20c065a0, priority=0, domain=inspect-ip-options, deny=true
hits=43139, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, nsg_id=none
input_ifc=Outside(vrfid:0), output_ifc=any

Phase: 8
Type: FOVER
Subtype: standby-update
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x14de05940910, priority=20, domain=lu, deny=false
hits=328, user_data=0x0, cs_id=0x0, flags=0x0, protocol=6
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, nsg_id=none
input_ifc=Outside(vrfid:0), output_ifc=any

Phase: 9
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x14de1ee47c10, priority=13, domain=ipsec-tunnel-flow, deny=true
hits=1105, user_data=0x0, cs_id=0x0, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, nsg_id=none
input_ifc=Outside(vrfid:0), output_ifc=any

Phase: 10
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Reverse Flow based lookup yields rule:
in id=0x14ddc6fcedf0, priority=0, domain=nat-per-session, deny=false
hits=11674650, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, nsg_id=none
input_ifc=any, output_ifc=any

Phase: 11
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Reverse Flow based lookup yields rule:
in id=0x14de11aa3f20, priority=0, domain=inspect-ip-options, deny=true
hits=68138, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, nsg_id=none
input_ifc=Inside_Lan(vrfid:0), output_ifc=any

Phase: 12
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 8645635, packet dispatched to next module
Module information for forward flow ...
snp_fp_inspect_ip_options
snp_fp_tcp_normalizer
snp_fp_translate
snp_fp_adjacency
snp_fp_fragment
snp_fp_tracer_drop
snp_ifc_stat

Module information for reverse flow ...
snp_fp_inspect_ip_options
snp_fp_translate
snp_fp_tcp_normalizer
snp_fp_adjacency
snp_fp_fragment
snp_fp_tracer_drop
snp_ifc_stat

Phase: 13
Type: INPUT-ROUTE-LOOKUP-FROM-OUTPUT-ROUTE-LOOKUP
Subtype: Resolve Preferred Egress interface
Result: ALLOW
Config:
Additional Information:
Found next-hop 10.10.20.2 using egress ifc Inside_Lan(vrfid:0)

Phase: 14
Type: ADJACENCY-LOOKUP
Subtype: Resolve Nexthop IP address to MAC
Result: ALLOW
Config:
Additional Information:
Found adjacency entry for Next-hop 10.10.20.2 on interface Inside_Lan
Adjacency :Active
MAC address 0000.0c07.ac32 hits 151743 reference 131

Result:
input-interface: Outside(vrfid:0)
input-status: up
input-line-status: up
output-interface: Inside_Lan(vrfid:0)
output-status: up
output-line-status: up
Action: allow

MHM Cisco World · ‎06-26-2023

there is no issue with VPN pool and ACL and NAT
NOW
there is something drop anyconnect, what is auth you use Cert.?

Dipak Masurkar · ‎06-26-2023

Its self signed cert and local authentication with realm

MHM Cisco World · ‎06-26-2023

when you generate Cert. are you use correct FQDN of FTD ?

Dipak Masurkar · ‎06-26-2023

I have generate fresh cert before 5 days with custom FQDN.

My topology as below-

Natting is happening on router, i have nat my FTD outside interface ip for VPN.

MHM Cisco World · ‎06-26-2023

you use NAT 1:1 or Port forwarding ?

Dipak Masurkar · ‎06-26-2023

1:1 nat with public static ip

MHM Cisco World · ‎06-27-2023

there are two Edge router, from FW you config static route toward VIP
from Edge router can you show nat translate when you try to anyconnect to FW?

Dipak Masurkar · ‎06-27-2023

Below nat entry found

Pro Inside global Inside local Outside local Outside global

MHM Cisco World · ‎06-27-2023

the port must be 443 (anyconnect)
OK from the PC (anyconnect)
do
telenet <public IP> port 443
share what you get
and when you telnet check NAT again

Dipak Masurkar · ‎06-27-2023

when checked 443 port with ping.eu its showing closed and also checked telnet it is not working.

MHM Cisco World · ‎06-27-2023

What you get from telnet exactly
if you so sure that the port close
then try using unknown port to access 443 of FW
i.e. in anyconnect try connect using port 4443 not 443
and in router use NATing from 4443 to 443
and check again.

Aref Alsouqi · ‎06-27-2023

Could you please share the static NAT rule you configured on the edge routers for AnyConnect traffic destined to the firewalls? also, the output you shared shows port 137/udp, not sure why is that. As @MHM Cisco World mentioned the SSL VPN traffic will be destined to port 443 in inbound, so your edge routers need to be configured with a NAT rule to forward that traffic to the firewalls.