Unable to access "inside" LAN from AnyConnect VPN

[Charger1129]

Hi. I'm having some trouble with my VPN connection where I can connect to it fine, and get internet access, but I cannot access the internal LAN. Does anyone have any thoughts on what I can check to resolve that? 

[Kannan Ramasubramanian]

Hi,

    When you say you can access internet but not internal LAN resources, I belive you've configured Split-tunnel. The most common issue could be because of NAT-Exemption statement being missed. Ensure that you've configured NAT-Exemption with source as inside LAN subnets and destination as Anyconnect VPN Pool. You can confirm the same by running packet-tracer command. Please get the following output, split-acl configuration, Anyconnect VPN pool and the subnet you're trying to access so that I can have a look into it.

---------------------------------------------------------------------------------------------------------------------------------------------

Packet-tracer input inside icmp <Internal_host_ip_address> 8 0 <Anyconnect_assigned_ip_address> detail

Internal_host_ip_address à The internal host (desktop) which you are trying to access

Anyconnect_assigned_ip_address à IP address assigned to the client machine once connected to vpn. This must be from VPN pool configured

---------------------------------------------------------------------------------------------------------------------------------------------

HTH,

Kannan

[Richard Burts · Accepted solution]

I believe that the suggestion about NAT exemption is very good. If that does not turn out to be the issue then I have a couple of other suggestions.

- with the VPN session established look into the information from the AnyConnect and look into the route details tab and be sure that these LAN addresses show up as secured routes.

- verify that the devices in the LAN that you can not reach have a route to the addresses in the VPN pool.

HTH

Rick

[Charger1129]

Hi Rich,

Looks like I only have the following for the routes which could be my issue:

Non-Secured Routes

• (0.0.0.0/0)

Secured Routes

• (10.31.90.0/24)

The 10.31.90.0 is my VPN network. The Network I am trying to reach is the 10.31.20.0 

[Richard Burts]

Yes that would be an issue and would explain the symptom that you are having. You need to make sure that your configuration for split tunnel also includes your inside addresses.

HTH

Rick

[Charger1129]

Figured it out now, had my ACL statements and NAT backwards by listing the VPN subnet as the source when really it should have been the destination.

Incorrect:

access-list SPLIT_TUNNEL extended permit ip object NETWORK_OBJ_10.31.90.0_24 object NETWORK_OBJ_10.31.20.0_24  

nat (inside,outside) source static NETWORK_OBJ_10.31.90.0_24 NETWORK_OBJ_10.31.90.0_24 destination static NETWORK_OBJ_10.31.20.0_24 NETWORK_OBJ_10.31.20.0_24 no-proxy-arp route-lookup

Correct:

access-list SPLIT_TUNNEL extended permit ip object NETWORK_OBJ_10.31.20.0_24 object NETWORK_OBJ_10.31.90.0_24  

nat (inside,outside) source static NETWORK_OBJ_10.31.20.0_24 NETWORK_OBJ_10.31.20.0_24 destination static NETWORK_OBJ_10.31.90.0_24 NETWORK_OBJ_10.31.90.0_24 no-proxy-arp route-lookup

[Richard Burts]

I am glad that my suggestion was helpful and did lead you to a solution. Thank you for posting back to the forum to explain just what was wrong and what you did to correct it. This will help other readers in the forum who may have a similar issue. And with VPN it does sometimes get difficult to sort out which address goes first and which goes second in access list. Thank you for using the rating system to mark this question as answered.

HTH

Rick