Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

AnyConnect SSL VPN Connected but unable to ping my inside LAN

Hi there, please forgive if I have missed any forum protocols as this is my first post.

I am trying to configure Anyconnect SSL VPN and it is killing me, I am able to connect to the VPN on a laptop, witch is able to download the anyconnect client from the ASA and I can also connect to the VPN using the Cisco anyconnect app but....... I am unable to ping any of my IP's that are on the inside of my ASA. Before posting here I have spent many hours on forums and watching videos on anyconnect SSL VPN creation and I am following it to the T but still no ping. Any help would be very much appreciated.

Inside              10.17.1.254/24

Outside           192.168.1.254/24

VPN Pool        10.99.1.1-50/24

Inside LAN     10.17.1.0/24

---------------------------------------------------------------

ASA Version 8.4(2)

!

hostname ciscoasa

enable password ft5r/Vn.VedHFe0u encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

ip address 10.17.1.254 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address 192.168.1.253 255.255.255.0

!

ftp mode passive

object network obj_any

subnet 0.0.0.0 0.0.0.0

object network NETWORK_OBJ_10.99.1.0_26

subnet 10.99.1.0 255.255.255.192

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

ip local pool ACPool 10.99.1.1-10.99.1.50 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (inside,outside) source static any any destination static NETWORK_OBJ_10.99.1.0_26 NETWORK_OBJ_10.99.1.0_26 no-proxy-arp route-lookup

!

object network obj_any

nat (inside,outside) dynamic interface

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

http server enable

http 10.17.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

telnet timeout 5

ssh timeout 5

console timeout 0

dhcp-client client-id interface outside

dhcpd auto_config outside

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

enable outside

anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1

anyconnect enable

tunnel-group-list enable

group-policy GroupPolicy_ACSSLVPN internal

group-policy GroupPolicy_ACSSLVPN attributes

wins-server none

dns-server value 10.17.1.1

vpn-tunnel-protocol ssl-client

default-domain none

username Earth password YwTxEzMBQFaeRlOE encrypted

tunnel-group ACSSLVPN type remote-access

tunnel-group ACSSLVPN general-attributes

address-pool ACPool

default-group-policy GroupPolicy_ACSSLVPN

tunnel-group ACSSLVPN webvpn-attributes

group-alias ACSSLVPN enable

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect ip-options

!

service-policy global_policy global

prompt hostname context

call-home reporting anonymous prompt 2

Cryptochecksum:48f9a08dc4ac36ac9bf227fb0df7080f

: end

ciscoasa#

2 REPLIES
Cisco Employee

AnyConnect SSL VPN Connected but unable to ping my inside LAN

A few things to add/change:

1) Remove:

nat (inside,outside) source static any any destination static  NETWORK_OBJ_10.99.1.0_26 NETWORK_OBJ_10.99.1.0_26 no-proxy-arp  route-lookup

and configure the following:

object network NETWORK_OBJ_10.17.1.0

    subnet 10.17.1.0 255.255.255.0

nat (inside,outside) source static NETWORK_OBJ_10.17.1.0 NETWORK_OBJ_10.17.1.0 destination static  NETWORK_OBJ_10.99.1.0_26 NETWORK_OBJ_10.99.1.0_26

2) Add: management-access inside

3) Add:

policy-map global_policy

  class inspection_default

     inspect icmp

4) Did you remove your default route? Didn't see that in the configuration.

Test to see if you can ping 10.17.1.254.

New Member

AnyConnect SSL VPN Connected but unable to ping my inside LAN

Hey Jennifer.

Thank you for the reply I have add/changed what you suggested but to the same out come, my client is able to connect but no ping. I am unable to ping both 10.17.1.254 or .1

Ref point 4 I have these routes, I thought this would be my default route for my remote clinet?

C    10.17.1.0 255.255.255.0 is directly connected, inside

S    10.99.1.1 255.255.255.255 [1/0] via 192.168.1.43, outside

C    192.168.1.0 255.255.255.0 is directly connected, outside

Below is a diagram of what I am tring to achive (thought I would start simple to avide problems...Doh)

Again any think you can sugget would help me greatly (I dont want to go back to OpenVPN)

ASA Version 8.4(2)

!

hostname ciscoasa

enable password ft5r/Vn.VedHFe0u encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

ip address 10.17.1.254 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address 192.168.1.253 255.255.255.0

!

ftp mode passive

object network obj_any

subnet 0.0.0.0 0.0.0.0

object network NETWORK_OBJ_10.99.1.0_26

subnet 10.99.1.0 255.255.255.192

object network NETWORK_OBJ_10.17.1.0

subnet 10.17.1.0 255.255.255.0

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

ip local pool ACPool 10.99.1.1-10.99.1.50 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (inside,outside) source static NETWORK_OBJ_10.17.1.0 NETWORK_OBJ_10.17.1.0 destination static NETWORK_OBJ_10.99.1.0_26 NETWORK_OBJ_10.99.1.0_26

!

object network obj_any

nat (inside,outside) dynamic interface

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

http server enable

http 10.17.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

telnet timeout 5

ssh timeout 5

console timeout 0

management-access inside

dhcp-client client-id interface outside

dhcpd auto_config outside

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

enable outside

anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1

anyconnect enable

tunnel-group-list enable

group-policy GroupPolicy_ACSSLVPN internal

group-policy GroupPolicy_ACSSLVPN attributes

wins-server none

dns-server value 10.17.1.1

vpn-tunnel-protocol ssl-client

default-domain none

username Earth password YwTxEzMBQFaeRlOE encrypted

tunnel-group ACSSLVPN type remote-access

tunnel-group ACSSLVPN general-attributes

address-pool ACPool

default-group-policy GroupPolicy_ACSSLVPN

tunnel-group ACSSLVPN webvpn-attributes

group-alias ACSSLVPN enable

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

  inspect ip-options

  inspect icmp

!

service-policy global_policy global

prompt hostname context

call-home reporting anonymous prompt 1

Cryptochecksum:b50677f05219752d32a3ed7589c1738c

: end

2379
Views
0
Helpful
2
Replies
CreatePlease login to create content