cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3668
Views
10
Helpful
3
Replies

Anyconnect No assigned address problem

faghouri83
Level 1
Level 1

Hi everyone

Im just playing around with Anyconnect before i have to implement it for real. Ive just put the minimal config on an asa 5540 but im having problems connecting. When i put my username and password into the anyconnect fields it authenticates but then comes up with "No assigned address" error. Ive used the ssl vpn Wizard for the basic setup. Can anyone spot a mistake in my config?:

interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 10.10.10.1 255.255.255.0
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0
!
interface GigabitEthernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
ftp mode passive
access-list NONAT extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
pager lines 24
logging asdm informational
mtu management 1500
mtu outside 1500
mtu inside 1500
ip local pool proper 192.168.10.1-192.168.10.20 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-613.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (inside) 1 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 10.10.10.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
enable outside
svc image disk0:/anyconnect-win-2.4.1012-k9.pkg 1
svc enable
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
webvpn
  svc ask enable
username myname password jPMT4rxVMt2ea3il encrypted privilege 0
username myname attributes
vpn-group-policy DfltGrpPolicy
tunnel-group test type remote-access
tunnel-group test general-attributes
address-pool proper
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny 
  inspect sunrpc
  inspect xdmcp
  inspect sip 
  inspect netbios
  inspect tftp

Thanks

3 Replies 3

Jennifer Halim
Cisco Employee
Cisco Employee

Try adding the following:

group-policy DfltGrpPolicy attributes

     address-pool value proper

Thanks! it worked! but now im wondering why the SSL VPN

wizard didnt add this bit in?

Good question.

I never use the SSL Wizard myself, however, from the configuration, it seems that you are using the DfltGrpPolicy group-policy, and the wizard seems to only add them to the tunnel-group. Since you configure username with specific attributes referring to the DfltGrpPolicy group-policy, you are getting the pool not assigned message.