VPN dropping traffic

[ludo.vandenbosch]

We are configuring a asa 5505 with anyconnect. But traffic from are vpn-pool to the local network is being droppped. but traffic from the inside network to the vpn client isn't being dropped. Any Help

[AllertGen]

Hello, ludo.vandenbosch@vagga.be.

I think it can be because you don't have a "vpn-filter" inside "group-policy GroupPolicy_VAGGA-VPN attributes". And because you securety-level for outside interface is 0 all traffic from VPN is dropped.

Try this:

group-policy GroupPolicy_VAGGA-VPN attributes
 vpn-filter value anyconnect
exit

Also at your attachment is a lot of private information. It's better to hide it.

[ludo.vandenbosch]

I Tried this one but get no result. When I do a packet trace from the vpn client ip to a internal client I get the following. I forgot Nat in my config from the anyconnect pool 2 the local network. After this it worked. But when i copied the config to a production machine it failed again. Now I'm clueless 

Phase: 8
Type: VPN
Subtype: ipsec-tunnel-flow
Result: DROP
Config:
Additional Information:

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

[AllertGen · Accepted solution]

Hi ludo.vandenbosch@vagga.be.

Can you also delete line "access-group anyconnect in interface outside" bur leave a vpn-filter at the configuration?

Also you can add a line deny any any at the end of each ACL to see which is blocking traffic.

Best Regards.

[burleyman]

Now that you added the NAT rule in production can you post the config?

[ludo.vandenbosch]

We can ping from outside to inside but nothing else file sharing etc. From inside 2 outside filsharing is possible (acl ?)