User Any connect VPN

[khoirul.iman]

Hi All

I have a problem. I already setting up VPN Anyconnect on Cisco ASA 5512.

But when user success establish connection and user connected to internal network and internet. Then no long after that, network internal getting down (all the users internal cannot connected to anything) and administrator also can not access interface ASA from VPN connection.

If any problem in my NAT configuration, the user cannot connect to internal and internet from their begin establish connection.

I attach my show run configuration

[jj27]

With a quick glance, try the following:

no nat (any,outside) source dynamic NETWORK_OBJ_192.168.120.0 interface
object network NETWORK_OBJ_192.168.120.0
 subnet 192.168.120.0 255.255.255.240
 nat(outside,outside) dynamic interface
no nat (poc,outside) source static any any destination static NETWORK_OBJ_192.168.120.0 NETWORK_OBJ_192.168.120.0 no-proxy-arp route-lookup
nat (poc,outside) 1 source static Net-Local Net-Local destination static NETWORK_OBJ_192.168.120.0 NETWORK_OBJ_192.168.120.0 no-proxy-arp route-lookup

[khoirul.iman]

Hi John,

I am still can not solved the problem. User from internal could PING inside interface but couldn't PING outside interface

Thanks

Khoirul

[David Castro F.]

Hello Khoirul,

According to your VPN configuration I found this:

nat (any,outside) source dynamic NETWORK_OBJ_192.168.120.0 interface **********************
nat (poc,outside) source static any any destination static NETWORK_OBJ_192.168.120.0 NETWORK_OBJ_192.168.120.0 no-proxy-arp route-lookup

VPN Pool:
ip local pool vpn 192.168.120.1-192.168.120.10 mask 255.255.255.0

So it seems that the very first NAT statement is taking precedence over the NAT exemption in the NAT order of operation, so you will need to do the following, delete the NAT statement for the NAT exemption and put a priority Number:

no nat (poc,outside) source static any any destination static NETWORK_OBJ_192.168.120.0 NETWORK_OBJ_192.168.120.0 no-proxy-arp route-lookup

nat (poc,outside) 1 source static any any destination static NETWORK_OBJ_192.168.120.0 NETWORK_OBJ_192.168.120.0 no-proxy-arp route-lookup 

I can see that you are running tunnel-all and providing access to internet to the users using U-Turn, which it will still work, go ahead and run a packet tracer from inside to the outside (VPN pool) so we can see that it is taking the correct NAT,

Please proceed to rate and mark as correct the helpful post! keep me posted!

Regards

David Castro,

[khoirul.iman]

Hi David

This the solutions that I done for this case :

1. no nat (inside,outside) source static any any

2. no nat (inside,outside) source static Net-Local interface

Because it affects arp cache

Regards,

Khoirul