Connecting to ASA Management (ASDM\SSH) via VPN

[gal.avichid]

Hey,

I have set multi tunnels between few ASA's + Anyconnect VPN gateway on the 'main' ASA with public IP (lets say 150.1.0.1)

I can communicate between the remote locations, connect to the VPN via my laptop, and communicate with all locations.

I would like to access the management (ASDM\SSH) via my laptop when connected to the VPN.

I have set the static IP in the ACL of the GroupPolicy. Created rule for SSH+HTTPS connection via the pool IP set in the VPN (lets say 10.22.0.0/24)

I can confirm the VPN is routing the static IP address, but no success when trying to login via SSH\HTTPS.

I tried to ping the static IP via my laptop, and I can see in the syslog the ICMP is from my ISP IP address and not the VPN address.

Any suggestion what else I could have missed?

*I can login to SSH+HTTPS via one of my remote locations, (via the tunnel) 

Thank you

[gal.avichid]

That will be too open to allow SSH from all ip's.

There is other solution I can use to allow SSH access via the VPN? for the user's which are connected to the VPN.

Thanks 

[MHM Cisco World]

Instead of ssh 0.0.0.0 use 

Ssh <vpn pool> 

Check this.

Also you can add vpn-filter permit/deny specific ip to access mgmt ip

[gal.avichid]

Its what I did. but somehow when I set it like that, I can't connect. only if I keep it on 0.0.0.0.

How can I add the VPN-filter?

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/99103-pix-asa-vpn-filter.html

[gal.avichid]

I have tried adding the filter, but still I get no access when trying to access via the anyconnect VPN.

I guess as @Rob Ingram mentioned, I am trying to achieve something that is not possible?

There is maybe another way to do that?

Maybe set another interface and allow the access via this interface via the VPN?

[MHM Cisco World]

You mention before you can access with ssh 0.0.0.0 ??

https://howdoesinternetwork.com/2016/asa-packet-processing

[Salman Mahajan]

@MHM Cisco World  He is able to access with SSH 0.0.0.0 , thats because in both case with or without vpn , the traffic is going via PC's local internet only and not through Anyconnect . 

[MHM Cisco World]

He ssh using public IP' the traffic hit outside and drop' so he use vpn anyconnect that why he can bypass outside low security level access to high security level.

The vpn can bypass the allow all traffic.

So sure he use vpn to ssh to asa.

[Salman Mahajan]

I bet SSH traffic is not going via Anyconnect in anycase . It would have otherwise worked when CLI is SSH 10.22.0.0 255.255.255.0 outside . 

At first he has to add Outside Ip in SPLIT ACL so that it appears in " Secure Routes " of Anyconnect for it to send it via tunnel ( i am assuming he has ) . Even with that , the route on PC for ASA outside ip will have next hop as Local Gateway and not Anyconnect Gateway ip - which is due to Outside IP address being the terminating IP for Anyconnect . 

[MHM Cisco World]

SORRY  maybe I am not clear 

I MEAN by ssh 0.0.0.0 is 

Ssh 0.0.0.0 0.0.0.0 (mgmt or IN)

Please @gal.avichid please confirm that you not use OUT as interface for SSH

[Salman Mahajan]

It should work via Anyconnect with SSH 0.0.0.0 ( any interface but not OUT ) . 

[Salman Mahajan]

Hi @gal.avichid , 

Management/SSH access to Outside interface via RA-VPN will not work if RA-VPN terminating interface is the same as management .  I suggest to set another interface for the same . It is expected to work when CLI  " SSH 0.0.0.0 0.0.0.0 outside " .

Please feel free to ask if you still have any query on the same 

Kindly mark my response as Helpful if it helps your issue ! 

[gal.avichid]

Hi @Salman Mahajan 
I am not sure what you meant? The idea is to set another interface and allow SSH via this interface?

Where this ASA is connected there is only internet connection, no any computer\network or any devices besides of the ASA.