Anyconnect No assigned address problem

Unanswered Question
Sep 29th, 2010

Hi everyone

Im just playing around with Anyconnect before i have to implement it for real. Ive just put the minimal config on an asa 5540 but im having problems connecting. When i put my username and password into the anyconnect fields it authenticates but then comes up with "No assigned address" error. Ive used the ssl vpn Wizard for the basic setup. Can anyone spot a mistake in my config?:

interface GigabitEthernet0/0
nameif outside
security-level 0
ip address
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address
interface GigabitEthernet0/2
no nameif
no security-level
no ip address
interface GigabitEthernet0/3
no nameif
no security-level
no ip address
interface Management0/0
nameif management
security-level 100
ip address
ftp mode passive
access-list NONAT extended permit ip
pager lines 24
logging asdm informational
mtu management 1500
mtu outside 1500
mtu inside 1500
ip local pool proper mask
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-613.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1
route outside 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
http server enable
http management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address management
dhcpd enable management
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
enable outside
svc image disk0:/anyconnect-win-2.4.1012-k9.pkg 1
svc enable
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
  svc ask enable
username myname password jPMT4rxVMt2ea3il encrypted privilege 0
username myname attributes
vpn-group-policy DfltGrpPolicy
tunnel-group test type remote-access
tunnel-group test general-attributes
address-pool proper
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny 
  inspect sunrpc
  inspect xdmcp
  inspect sip 
  inspect netbios
  inspect tftp


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Jennifer Halim Wed, 09/29/2010 - 07:46

Try adding the following:

group-policy DfltGrpPolicy attributes

     address-pool value proper

faghouri83 Wed, 09/29/2010 - 07:52

Thanks! it worked! but now im wondering why the SSL VPN

wizard didnt add this bit in?

Jennifer Halim Wed, 09/29/2010 - 08:01

Good question.

I never use the SSL Wizard myself, however, from the configuration, it seems that you are using the DfltGrpPolicy group-policy, and the wizard seems to only add them to the tunnel-group. Since you configure username with specific attributes referring to the DfltGrpPolicy group-policy, you are getting the pool not assigned message.


This Discussion