×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

ASA 9.1 Anyconnect split-tunnel ICMP issue

Unanswered Question
May 7th, 2014
User Badges:

Hello all,

I am having the hardest time with getting VPN clients access to ICMP into the internal network behind the FW. I have tested HTTP and SSH fine for inbound VPN client connections, but their pings fail always. They seem to hit their destinations, but are blocked on the return for some reason. Packet-Tracer states it is due to an ACL rule, but I have no applied at the moment, as I am labbing up a new system for deployment. Any help would be great.

 

packet-tracer input outside icmp 10.0.4.130 8 0 11  10.0.12.1

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   10.0.12.0       255.255.255.252 Inside

Phase: 2
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (Outside,Inside) source static ANYCONNECT_VPNs ANYCONNECT_VPNs
Additional Information:

Phase: 3
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 4
Type: ACCESS-LIST
Subtype:      
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: Outside
input-status: up
input-line-status: up
output-interface: Inside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

the reverse works though:

 

HJSHS-A106-ASA(config)# packet-tracer input outside icmp 10.0.12.1 0 8 11 10.0$

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   10.0.4.130      255.255.255.255 Outside

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:

Phase: 3
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: WEBVPN-SVC
Subtype: out
Result: ALLOW
Config:       
Additional Information:

Phase: 8
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 3204, packet dispatched to next module

Result:
input-interface: Outside
input-status: up
input-line-status: up
output-interface: Outside
output-status: up
output-line-status: up
Action: allow

=======================================

Here is the config:

access-list Split-Tunnel remark Total LAN Network
access-list Split-Tunnel standard deny 10.0.4.96 255.255.255.224
access-list Split-Tunnel standard deny 10.0.4.128 255.255.255.224
access-list Split-Tunnel standard permit 10.0.0.0 255.255.0.0
access-list test extended permit ip any any log

access-group test in interface Inside
access-group test out interface Inside

interface Port-channel12
 nameif Inside
 security-level 100
 ip address 10.0.12.2 255.255.255.252
!
interface Port-channel14
 nameif Outside
 security-level 1
 ip address <removed> 255.255.255.248

Port-channel12             10.0.12.2       YES CONFIG up                    up  
Port-channel14             <removed> YES CONFIG up                    up 

 

ip local pool TEACHER_VPN 10.0.4.98-10.0.4.126 mask 255.255.255.224
ip local pool IT_VPN 10.0.4.130-10.0.4.158 mask 255.255.255.224

Below is more of the config:

boot system disk0:/asa912-smp-k8.bin
ftp mode passive
same-security-traffic permit intra-interface
object-group service internet-udp udp
 description UDP Standard Internet Services
 port-object eq domain
 port-object eq ntp
 port-object eq isakmp
 port-object eq 4500
object-group service Internet-tcp tcp
 description TCP Standard Internet Services
 port-object eq www
 port-object eq https
 port-object eq smtp
 port-object eq 465
 port-object eq pop3
 port-object eq 995
 port-object eq ftp
 port-object eq ftp-data
 port-object eq domain
 port-object eq ssh
 port-object eq telnet
object-group network NAT_SOURCE
 network-object 10.0.0.0 255.255.0.0
object-group network ANYCONNECT_VPNs
 network-object 10.0.4.128 255.255.255.224
 network-object 10.0.4.96 255.255.255.224
nat (Inside,Outside) source dynamic NAT_SOURCE interface
nat (Outside,Inside) source static ANYCONNECT_VPNs ANYCONNECT_VPNs
nat (Inside,Inside) source static ANYCONNECT_VPNs ANYCONNECT_VPNs
nat (Inside,Inside) source static NAT_SOURCE NAT_SOURCE
route Outside 0.0.0.0 0.0.0.0 <removed> 1
route Inside 10.0.0.0 255.255.0.0 10.0.12.1 1
route Inside 172.30.0.0 255.255.0.0 10.0.12.1 1
http server enable
http 172.30.0.0 255.255.0.0 Inside
http redirect Outside 80
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev2 ipsec-proposal DES
 protocol esp encryption des
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
 protocol esp encryption 3des
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
 protocol esp encryption aes
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
 protocol esp encryption aes-192
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
 protocol esp encryption aes-256
 protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map Outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map Outside_map interface Outside
crypto ca trustpool policy
crypto ikev2 policy 1
 encryption aes-256
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 10
 encryption aes-192
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 20
 encryption aes
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 30
 encryption 3des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 enable Outside client-services port 443
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 Inside
ssh timeout 20
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 20
management-access Inside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn        
 enable Outside
 anyconnect image disk0:/anyconnect-win-3.1.05160-k9.pkg 1
 anyconnect enable
 tunnel-group-list enable
group-policy GroupPolicy_IT internal
group-policy GroupPolicy_IT attributes
 wins-server none
 dns-server value 8.8.8.8
 vpn-tunnel-protocol ssl-client
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value Split-Tunnel
 default-domain value <removed>
 address-pools value IT_VPN
group-policy GroupPolicy_Teachers internal
group-policy GroupPolicy_Teachers attributes
 wins-server none
 dns-server value 8.8.8.8
 vpn-tunnel-protocol ssl-client
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value Split-Tunnel
 default-domain value <removed>
 address-pools value TEACHER_VPN
username admin password <removed> encrypted privilege 15
tunnel-group TunnelGroup_IT type remote-access
tunnel-group TunnelGroup_IT general-attributes
 address-pool IT_VPN
 default-group-policy GroupPolicy_IT
tunnel-group TunnelGroup_IT webvpn-attributes
 group-alias IT_Workers enable
tunnel-group TunnelGroup_Teachers type remote-access
tunnel-group TunnelGroup_Teachers general-attributes
 address-pool TEACHER_VPN
 default-group-policy GroupPolicy_Teachers
tunnel-group TunnelGroup_Teachers webvpn-attributes
 group-alias Teachers enable
!
class-map inspection_additional
 match port tcp eq ssh
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny  
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip  
  inspect xdmcp
 class inspection_additional

 

Here are some of the connection logs from a switch I used which sits behind the ASA:

 

*May  7 12:48:14.342: FIBipv4-packet-proc: route packet from Vlan100 src 10.0.4.130 dst 10.0.12.1
*May  7 12:48:14.342: FIBfwd-proc: Default:10.0.12.1/32 receive entry
*May  7 12:48:14.342: FIBipv4-packet-proc: packet routing failed
*May  7 12:48:14.342: IP: s=10.0.4.130 (Vlan100), d=10.0.12.1, len 52, rcvd 2
*May  7 12:48:14.342:     TCP src=50891, dst=443, seq=2731020968, ack=0, win=8192 SYN
*May  7 12:48:14.342: IP: s=10.0.4.130 (Vlan100), d=10.0.12.1, len 52, stop process pak for forus packet
*May  7 12:48:14.342:     TCP src=50891, dst=443, seq=2731020968, ack=0, win=8192 SYN
*May  7 12:48:14.342: IP: s=10.0.12.1 (local), d=10.0.4.130, len 40, local feature
*May  7 12:48:14.342:     TCP src=443, dst=50891, seq=0, ack=2731020969, win=0 ACK RST, Local Clustering(8), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*May  7 12:48:14.342: FIBipv4-packet-proc: route packet from (local) src 10.0.12.1 dst 10.0.4.130
*May  7 12:48:14.342: FIBfwd-proc: packet routed by adj to Vlan100 10.0.4.130
*May  7 12:48:14.342: FIBipv4-packet-proc: packet routing succeeded
*May  7 12:48:14.342: IP: tableid=0, s=10.0.12.1 (local), d=10.0.4.130 (Vlan100), routed via FIB
*May  7 12:48:14.342: IP: s=10.0.12.1 (local), d=10.0.4.130 (Vlan100), len 40, sending
*May  7 12:48:14.342:     TCP src=443, dst=50891, seq=0, ack=2731020969, win=0 ACK RST
*May  7 12:48:14.342: IP: s=10.0.12.1 (local), d=10.0.4.130 (Vlan100), len 40, sending full packet
*May  7 12:48:14.342:     TCP src=443, dst=50891, seq=0, ack=2731020969, win=0 ACK RST
*May  7 12:48:14.436: IP: s=10.0.12.1 (local), d=10.0.4.130, len 56, local feature
*May  7 12:48:14.436:     ICMP type=11, code=0, Local Clustering(8), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*May  7 12:48:14.436: FIBipv4-packet-proc: route packet from (local) src 10.0.12.1 dst 10.0.4.130
*May  7 12:48:14.436: FIBfwd-proc: packet routed by adj to Vlan100 10.0.4.130
*May  7 12:48:14.436: FIBipv4-packet-proc: packet routing succeeded
*May  7 12:48:14.436: IP: tableid=0, s=10.0.12.1 (local), d=10.0.4.130 (Vlan100), routed via FIB
*May  7 12:48:14.436: IP: s=10.0.12.1 (local), d=10.0.4.130 (Vlan100), len 56, sending
*May  7 12:48:14.436:     ICMP type=11, code=0

 

 

Again, the Client can connect through http/s, but ICMP isn't working which will be important for their IT in the future.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
CSCO12079629 Wed, 05/07/2014 - 16:40
User Badges:

I added to permit ip any any "test" acl in/out for the outside interface, and now I get this:

 

HJSHS-A106-ASA(config)# packet-tracer input outside icmp 10.0.4.130 8 0 11  10$

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   10.0.12.0       255.255.255.252 Inside

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group test in interface Outside
access-list test extended permit ip any any log
Additional Information:

Phase: 3
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (Outside,Inside) source static ANYCONNECT_VPNs ANYCONNECT_VPNs
Additional Information:
Static translate 10.0.4.130/11 to 10.0.4.130/11

Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: CP-PUNT
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: WEBVPN-SVC
Subtype: in
Result: DROP
Config:
Additional Information:

Result:
input-interface: Outside
input-status: up
input-line-status: up
output-interface: Inside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

 

I don't understand all this ASA config, I am much better with routers.

 

Marvin Rhoads Thu, 05/08/2014 - 06:51
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,
  • Cisco Designated VIP,

    2017 Firewalling, Network Management, VPN

A couple fo things to keep in mind:

VPN clients come from the outside (even though their address pools are private "inside" addresses). When a client is connected via VPN, their traffic inbound to the ASA destined for inside networks bypasses any outside interface access-list.

When you put any access-list on the inside interface (or any other interface), it changes the default behavior  (e.g. by default the ASA will allow any higher security interface to any lower security interface flow or connection). When an access-list is added, there is always a default deny any any at the end.

Ping uses icmp - a separate protocol type from IP. So "permit ip any any" will block icmp. You would need to add "permit icmp any any" (or simply remove the access-list altogether from the inside interface)

CSCO12079629 Mon, 05/12/2014 - 10:05
User Badges:

Thanks Marvin,

I will check this as I had permit ip any any configed. If it works, I will let everyone know.

 

Actions

This Discussion