Setup VPN Connection Profile and Anyconnect in Firepower 1010

[Markflan]

Hi All,

Ive followed a step by step guide to setting up a VPN connection profile in my new 1010 .... in one section ive to create a anyconnect IP pool which is fine and all looked good and the anyconnect is working but bare with me if this is a stupid question. So my internal office network IP range is 192.168.95.x and the newly created VPN Pool IP is 192.168.19.x .... reason its 19 is im not able to create a VPN pool with my exisiting IP ? so obviously this is the reason when i connect via anyconnect app i cant map or browse to my internal network ? but am i missing somthing here to allow this to work ? a rule or how to give the anyconnect my internal IP?

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215532-configure-remote-access-vpn-on-ftd-manag.html

sorry if this is a trivial thing to most but im not a cisco person but know somethings and definetly not fully up to speed on these Cisco FWs ?

thanks so much for any advice

Mark

[Markflan]

not having a good day with this Putty will just not work for me and i dont know how to access the  support firewall-engine-debug from the CLI ?? sorry  

[Rob Ingram]

@Markflan why does SSH not work? what error do you get? Ensure you are connecting to ssh using the correct IP address and that you are allowed to ssh to the FTD from your network. To confirm, from FDM GUI go to System Settings > Management access and allow your network (if not already) to connect using SSH (and https) from either the management and/or data interface - whatever you are using.

Or you could just connect directly using the console cable.

You won't be able to use system support firewall-engine-debug until you've connected via the CLI using SSH/console.

[Markflan]

Ahh SSH wasnt on ok ran packet-tracer input outside tcp 192.168.19.100 300 192.168.95.10 80 detailed

and ive attached this here now 

Im unfortunatley not on site or in the same country at the moment so im remotly connecting to the server to resolve this .. thanks 

[Rob Ingram]

@Markflan why is the object NGFW-Remote-Access-VPN the source and destination in the NAT rule?

Run "show nat detail" and "show running-config object" and provide the output.

Is the internal network 192.168.95.0 directly connected or do you have a route on the FTD pointing to the next hop?

[Markflan]

this one here ?

attached NAT and Config 

the internal Network is 95.0 connected  and i didnt setup any other routes or not intentionally anyway? 

[Rob Ingram]

Is the FTD the default gateway or is traffic routed via the FTD for the client devices you cannot connect to when on the RAVPN?

Can you actually ping the internal network (servers, PCs etc) from the FTD itself?

Did you run "show arp" as per the packet-tracer output?

Result:
input-interface: outside(vrfid:0)
input-status: up
input-line-status: up
output-interface: inside(vrfid:0)
output-status: up
output-line-status: up
Action: drop
Time Taken: 705309 ns
Drop-reason: (no-v4-adjacency) No valid V4 adjacency. Check ARP table (show arp) 

You've two Manual NAT rules, the packet-tracer is not matching the one you created. Although they appear to do the samething.

Manual NAT Policies (Section 1)
1 (inside) to (outside) source static NGFW-Remote-Access-VPN|natIpv4Grp NGFW-Remote-Access-VPN|natIpv4Grp destination static NGFW-Remote-Access-VPN|natIpv4PoolGrp NGFW-Remote-Access-VPN|natIpv4PoolGrp no-proxy-arp route-lookup
translate_hits = 1, untranslate_hits = 1
Source - Origin: 192.168.95.0/28, Translated: 192.168.95.0/28
Destination - Origin: 192.168.19.0/24, Translated: 192.168.19.0/24
2 (inside) to (outside) source static FDM_Local_Network FDM_Local_Network destination static Anyconnect_Pool Anyconnect_Pool
translate_hits = 0, untranslate_hits = 0
Source - Origin: 192.168.95.0/28, Translated: 192.168.95.0/28
Destination - Origin: 192.168.19.0/24, Translated: 192.168.19.0/24

[Markflan]

her eis my NAT rules one was in already and the other i created on your advice yesterday ?

FTD is the default gateway and i can ping my clients and servers from the FTD ,

im on my client laptop here at home and can conect into anyconnect but cant map or ping any client on the office 

arp attached 

[Rob Ingram]

@Markflan please run packet-tracer again but to a destination IP of an endpoint with an entry in the arp table and provide the output.

packet-tracer input outside tcp 192.168.19.100 3000 192.168.95.13 80 detailed

Do the client devices on the internal network have a local firewall that can block access from a network other than the local network address space?

Are you running a full VPN (no split tunnel)?

[Markflan]

new Packet attached   ,,, no additional FWs in any internal client ... as you will see split tunnel is on ?

[Markflan]

hi @Rob Ingram i know your probably very busy and have a normal job but if you do get any chance do any more insights   much apprecited for all your help so far .. Mark

[Pavan Gundu]

Do you mean accessing local networks when you are connected to VPN? Like a printer service on your office network?

[Markflan]

Hi @Pavan Gundu  yes im trying to acces my server aps and shares /?