Solved: AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw - Page 2

itmanager2 · ‎10-08-2013

My AnyConnect VPN connect to the ASA, however I cannot access my inside network hosts (tried Split Tunnel and it didn't work either). I plan to use a Split Tunnel configuration but I thought I would get this working before I implemented that configuration. My inside hosts are on a 10.0.1.0/24 network and 10.1.0.0/16 networks. My AnyConnect hosts are using 192.168.60.0/24 addresses.

I have seen other people that appeared to have similar posts but none of those solutions have worked for me. I have also tried several NAT and ACL configurations to allow traffic form my Inside network to the ANYConnect hosts and back, but apparently I did it incorrectly. I undestand that this ver 8.4 is supposed to be easier to perform NAT and such, but I now in the router IOS it was much simpler.

My configuration is included below.

Thank you in advance for your assistance.

Jerry

*************************************************************

ASA Version 8.4(4)

!

hostname mxfw

domain-name moxiefl.com

enable password (removed)

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

shutdown

!

interface Ethernet0/4

shutdown

!

interface Ethernet0/5

switchport trunk allowed vlan 20,22

switchport mode trunk

!

interface Ethernet0/6

shutdown

!

interface Ethernet0/7

shutdown

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

!

interface Vlan20

nameif dmz

security-level 50

ip address 172.26.20.1 255.255.255.0

!

interface Vlan22

nameif dmz2

security-level 50

ip address 172.26.22.1 255.255.255.0

!

ftp mode passive

dns domain-lookup inside

dns domain-lookup outside

dns server-group DefaultDNS

name-server 208.67.222.222

name-server 208.67.220.220

domain-name moxiefl.com

same-security-traffic permit inter-interface

object network Generic_All_Network

subnet 0.0.0.0 0.0.0.0

object network INSIDE_Hosts

subnet 10.1.0.0 255.255.0.0

object network AnyConnect_Hosts

subnet 192.168.60.0 255.255.255.0

object network NETWORK_OBJ_192.168.60.0_26

subnet 192.168.60.0 255.255.255.192

object network DMZ_Network

subnet 172.26.20.0 255.255.255.0

object network DMZ2_Network

subnet 172.26.22.0 255.255.255.0

pager lines 24

mtu inside 1500

mtu outside 1500

mtu dmz 1500

mtu dmz2 1500

ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (inside,outside) source dynamic Generic_All_Network interface

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.60.0_26 NETWORK_OBJ_192.168.60.0_26 no-proxy-arp route-lookup

nat (dmz,outside) source dynamic Generic_All_Network interface

nat (dmz2,outside) source dynamic Generic_All_Network interface

route inside 10.1.0.0 255.255.0.0 10.0.1.2 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

http server enable

http 10.0.0.0 255.0.0.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec ikev2 ipsec-proposal AES256

protocol esp encryption aes-256

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES192

protocol esp encryption aes-192

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES

protocol esp encryption aes

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal 3DES

protocol esp encryption 3des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal DES

protocol esp encryption des

protocol esp integrity sha-1 md5

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto ca trustpoint ASDM_TrustPoint0

enrollment self

fqdn anyconnect.moxiefl.com

subject-name CN=AnyConnect.moxiefl.com

keypair AnyConnect

proxy-ldc-issuer

crl configure

crypto ca certificate chain ASDM_TrustPoint0

certificate 439a4452

3082026c 308201d5 a0030201 02020443 9a445230 0d06092a 864886f7 0d010105

05003048 311f301d 06035504 03131641 6e79436f 6e6e6563 742e6d6f 78696566

6c2e636f 6d312530 2306092a 864886f7 0d010902 1616616e 79636f6e 6e656374

2e6d6f78 6965666c 2e636f6d 301e170d 31333039 32373037 32353331 5a170d32

33303932 35303732 3533315a 3048311f 301d0603 55040313 16416e79 436f6e6e

6563742e 6d6f7869 65666c2e 636f6d31 25302306 092a8648 86f70d01 09021616

616e7963 6f6e6e65 63742e6d 6f786965 666c2e63 6f6d3081 9f300d06 092a8648

86f70d01 01010500 03818d00 30818902 8181009a d9f320ff e93d4fdd cb707a4c

b4664c47 6d2cc639 4dc45fed bfbc2150 7109fd81 5d6a5252 3d40dc43 696360d5

fbf92bcc 477d19b8 5301085c daf40de5 87d7e4aa f81b8d7f 8d364dfa 0a6f07d7

6a7c3e9b 56e69152 aa5492d8 e35537bd 567ccf29 7afbeae8 13da9936 9f890d76

1d56d11d da3d039a 0e714849 e6841ff2 5483b102 03010001 a3633061 300f0603

551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06

03551d23 04183016 80142f27 7096c4c5 e396e691 e07ef737 af61b71f 64f1301d

0603551d 0e041604 142f2770 96c4c5e3 96e691e0 7ef737af 61b71f64 f1300d06

092a8648 86f70d01 01050500 03818100 8f777196 bbe6a5e4 8af9eb9a 514a8348

5e62d6cd 47257243 e430a758 2b367543 065d4ceb 582bf666 08ff7be1 f89287a2

ac527824 b11c2048 7fd2b50d 35ca3902 6aa00675 e4df7859 f3590596 b1d52426

1e97a52c 4e77f4b0 226dec09 713f7ba9 80bdf7bb b52a7da2 4a68b91b 455cabba

0cc4c6f3 f244f7d9 0a6e32fb 31ce7e35

quit

crypto ikev2 policy 1

encryption aes-256

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 10

encryption aes-192

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 20

encryption aes

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 30

encryption 3des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 40

encryption des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 enable outside client-services port 443

crypto ikev2 remote-access trustpoint ASDM_TrustPoint0

telnet timeout 5

ssh 10.0.0.0 255.0.0.0 inside

ssh timeout 5

ssh key-exchange group dh-group1-sha1

console timeout 0

dhcpd dns 208.67.222.222 208.67.220.220

dhcpd auto_config outside

!

dhcpd address 10.0.1.20-10.0.1.40 inside

dhcpd dns 208.67.222.222 208.67.220.220 interface inside

dhcpd enable inside

!

dhcpd address 172.26.20.21-172.26.20.60 dmz

dhcpd dns 208.67.222.222 208.67.220.220 interface dmz

dhcpd enable dmz

!

dhcpd address 172.26.22.21-172.26.22.200 dmz2

dhcpd dns 208.67.222.222 208.67.220.220 interface dmz2

dhcpd enable dmz2

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ssl trust-point ASDM_TrustPoint0 outside

webvpn

enable outside

anyconnect-essentials

anyconnect image disk0:/anyconnect-win-3.0.2052-k9.pkg 1

anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml

anyconnect enable

tunnel-group-list enable

group-policy GroupPolicy_AnyConnect internal

group-policy GroupPolicy_AnyConnect attributes

wins-server none

dns-server value 208.67.222.222 208.67.220.220

vpn-tunnel-protocol ikev2 ssl-client

default-domain value moxiefl.com

webvpn

anyconnect profiles value AnyConnect_client_profile type user

username user1 password $$$$$$$$$$$$$$$$$ encrypted privilege 15

username user2 password $$$$$$$$$$$$$$$$$ encrypted privilege 15

tunnel-group AnyConnect type remote-access

tunnel-group AnyConnect general-attributes

address-pool VPN_POOL

default-group-policy GroupPolicy_AnyConnect

tunnel-group AnyConnect webvpn-attributes

group-alias AnyConnect enable

!

class-map inspection_default

match default-inspection-traffic

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect ip-options

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

inspect icmp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

no active

destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

destination address email callhome@cisco.com

destination transport-method http

subscribe-to-alert-group diagnostic

subscribe-to-alert-group environment

subscribe-to-alert-group inventory periodic monthly

subscribe-to-alert-group configuration periodic monthly

subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:f2c7362097b71bcada023c6bbfc45121

: end

Jouni Forss · ‎10-10-2013

Hi,

I am not clear on what is blocking the traffic in your "packet-tracer"

In the previous one we can see that the traffic from the connected VPN Client user is matching the correct NAT configurations and the correct output interface is chosen. When the ASA has performed UN-NAT for the destination IP address it then goes on to check the ACL.

Here is where it gets strange,

There is a default setting called "sysopt connection permit-vpn" which doesnt show up in the CLI but does show up with the command I mentioned (which you provided before) that was "show run all sysopt"

This setting should allow all traffic from a VPN user to bypass any interface ACL you might have on the "outside" interface. Yet your traffic is getting blocked.

Since I am not sure what is causing this I would suggest testing the following

no sysopt connection permit-vpn

access-list OUTSIDE-IN remark Allow VPN Client traffic

access-list OUTSIDE-IN permit ip 192.168.60.0 255.255.255.0 10.1.0.0 255.255.0.0

access-list OUTSIDE-IN permit ip 192.168.60.0 255.255.255.0 10.0.1.0 255.255.255.0

access-group OUTSIDE-IN in interface outside

And then try to connect again with the VPN Client and take the "packet-tracer" output again and see if there is no change. If there is no change you could probably change back to the setting "sysopt connection permit-vpn"

After this I would probably consider getting some other software for the ASA because it seems to me that were pretty much exhausted the most typical reasons for this problem. Naturally I cant be 100% sure that I have checked everything that might be related to this.

At one point 8.4(5) was suggested to us to be one of the stablest/problem free software (I guess it depends on your setup really). You could try it if you can get your hands on the software. There is also versions 8.4(6) BUT there has been a couple of threads here on the forums where a user has encountered problems when using DHCP on the external interface. There should also be 8.4(7), then there is naturally the 9.x series software levels

With regards to the DMZ Vlan interface IP addresses I would see that as a clear problem related to the DMZ connectivity. They are using the .1 IP addresses as default gateways and if they ARP for the MAC address of that IP both the ASA and Switch could answer that ARP request.

- Jouni

itmanager2 · ‎10-11-2013

Jouni,

Well the packet-tracer worked see below.

But still Request timed out on my ping attempts from the AnyConnect computer.

So I did something I should have done earlier. I installed Wireshark on the PC I am trying to ping.

The pings are arriving on that PC. I know there is an issue with Wireshark not always seeing the outbound traffic of the interface it is monitoring, so the PC is probably sending the replies back, I just can't see them because of where I'm monitoring.

So, I then removed the access-group and turned sysopt connection permit-vpn
back on. I then VPN'd back into the network and did the ping again and it is getting to the PC (just still timing out).

The packet-tracer however goes back to failing as before - so that is probably a glitch in the packet-tracer.

The DMZ issue was resolved once I removed those IP addresses I missed and flushed the ARP table on the PC I was using to test with. Thanks again for catching that.

Based on the results below using Wireshark on both PCs, it appears the PCs are not Replying for teh failed Ping attempts. It appears everything is routing, but for some reason both PCs are not replying to some of the Echo Requests.

Network Ping Results Table:

Passes:

10.1.10.1 (VLAN 10 3560a) <-> 10.0.1.1 (ASA)

10.1.10.1 <-> 10.1.10.24 (PC - Wireshark shows Echo Request arriving and Echo Reply going back)

10.1.10.24 -> 10.0.1.1

192.168.60.20 -> 10.0.1.1

192.168.60.20 -> 10.1.10.1

Fails:

10.0.1.1 ->10.1.10.24 (Fails - but Wireshark shows Echo Request arriving at PC - no Echo Reply)

10.0.1.1 (192.168.1.231) -> 192.168.60.20 (Wireshark shows Echo Request arriving but no Echo Reply)

10.1.10.1 (10.0.1.2) -> 192.168.60.20 (Wireshark shows Echo Request arriving but no Echo Reply)

10.1.10.24 <-> 192.168.60.20 (Wireshark on each computer shows the Echo Request arriving but no Echo Reply)

**************************************************************

mxfw# packet-tracer input outside icmp 192.168.60.20 8 0 10.1.10.23 detailed

Phase: 1

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in id=0xac74d238, priority=1, domain=permit, deny=false

hits=446453, user_data=0x0, cs_id=0x0, l3_type=0x8

src mac=0000.0000.0000, mask=0000.0000.0000

dst mac=0000.0000.0000, mask=0100.0000.0000

input_ifc=outside, output_ifc=any

Phase: 2

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 10.1.0.0 255.255.0.0 inside

Phase: 3

Type: UN-NAT

Subtype: static

Result: ALLOW

Config:

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

Additional Information:

NAT divert to egress interface inside

Untranslate 10.1.10.23/0 to 10.1.10.23/0

Phase: 4

Type: ACCESS-LIST

Subtype: log

Result: ALLOW

Config:

access-group OUTSIDE-IN in interface outside

access-list OUTSIDE-IN extended permit ip 192.168.60.0 255.255.255.0 10.1.0.0 255.255.0.0

Additional Information:

Forward Flow based lookup yields rule:

in id=0xad053058, priority=13, domain=permit, deny=false

hits=16, user_data=0xa9a35f20, cs_id=0x0, use_real_addr, flags=0x0, protocol=0

src ip/id=192.168.60.0, mask=255.255.255.0, port=0

dst ip/id=10.1.0.0, mask=255.255.0.0, port=0, dscp=0x0

input_ifc=outside, output_ifc=any

Phase: 5

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xac751130, priority=0, domain=inspect-ip-options, deny=true

hits=10116, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0

src ip/id=0.0.0.0, mask=0.0.0.0, port=0

dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

input_ifc=outside, output_ifc=any

Phase: 6

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class inspection_default

inspect icmp

service-policy global_policy global

Additional Information:

Forward Flow based lookup yields rule:

in id=0xad230568, priority=70, domain=inspect-icmp, deny=false

hits=21, user_data=0xad2a9848, cs_id=0x0, use_real_addr, flags=0x0, protocol=1

src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0

dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0

input_ifc=outside, output_ifc=any

Phase: 7

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xac750d08, priority=66, domain=inspect-icmp-error, deny=false

hits=36, user_data=0xac750320, cs_id=0x0, use_real_addr, flags=0x0, protocol=1

src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0

dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0

input_ifc=outside, output_ifc=any

Phase: 8

Type: VPN

Subtype: ipsec-tunnel-flow

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xad053130, priority=13, domain=ipsec-tunnel-flow, deny=true

hits=297, user_data=0x0, cs_id=0x0, flags=0x0, protocol=0

src ip/id=0.0.0.0, mask=0.0.0.0, port=0

dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

input_ifc=outside, output_ifc=any

Phase: 9

Type: NAT

Subtype: rpf-check

Result: ALLOW

Config:

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

Additional Information:

Forward Flow based lookup yields rule:

out id=0xac7f5a78, priority=6, domain=nat-reverse, deny=false

hits=17, user_data=0xac7f5178, cs_id=0x0, use_real_addr, flags=0x0, protocol=0

src ip/id=192.168.60.0, mask=255.255.255.0, port=0

dst ip/id=10.1.0.0, mask=255.255.0.0, port=0, dscp=0x0

input_ifc=outside, output_ifc=inside

Phase: 10

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Reverse Flow based lookup yields rule:

in id=0xac7171b0, priority=0, domain=inspect-ip-options, deny=true

hits=9036, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0

src ip/id=0.0.0.0, mask=0.0.0.0, port=0

dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

input_ifc=inside, output_ifc=any

Phase: 11

Type: FLOW-CREATION

Subtype:

Result: ALLOW

Config:

Additional Information:

New flow created with id 10173, packet dispatched to next module

Module information for forward flow ...

snp_fp_tracer_drop

snp_fp_inspect_ip_options

snp_fp_inspect_icmp

snp_fp_translate

snp_fp_adjacency

snp_fp_fragment

snp_ifc_stat

Module information for reverse flow ...

snp_fp_tracer_drop

snp_fp_inspect_ip_options

snp_fp_translate

snp_fp_inspect_icmp

snp_fp_adjacency

snp_fp_fragment

snp_ifc_stat

Result:

input-interface: outside

input-status: up

input-line-status: up

output-interface: inside

output-status: up

output-line-status: up

Action: allow

Jouni Forss · ‎10-11-2013

Hi,

I think the previous "packet-tracer" you had posted didnt go through with regards to the ICMP test from the VPN Client and that is why I suggested the strange configurations.

The idea was to have the interface ACL configured with the "access-group" command and also have the "no sysopt connection permit-vpn" BUT as long as the connection is passing the ASA then its fine.

Have you considered the possibility that the PCs just wont reply to ICMP Echo?

I have had some problems with Windows hosts getting to reply to ICMP Echo whatever I have done. While they can ICMP to other network devices with no problems.

Do you have firewall software enabled on the hosts? Seems that everything else is replying to ICMP other than the actual hosts (LAN -> VPN, VPN -> LAN) Do you perhaps have some device for the LAN that you can attach to the same LAN as the actual hosts as a Dummy device that you know will reply to ICMP Echo and test traffic to that host from the VPN Client?

I didnt participate in the Firewall section dicussion but you can naturally rate the DMZ related reply if you found it to be helpfull.

Would like to solve the problem related to the VPN also.

- Jouni

itmanager2 · ‎10-11-2013

Jouni,

Well pings might not be working from computer to computer, but I setup a VNC server on my Inside network computer and I am able to access via the VPN.

Thank you again for all of your assistance.

Jerry

Jouni Forss · ‎10-11-2013

Hi,

Glad to hear you have gotten the actual TCP connections working

Have a look at my above post. I think you might have been posting while I was writing that.

If everything is ok then please remember to mark a reply as the correct answer if it answered your question and/or rate helpfull answers

Though naturally if there is still some problems feel free to ask/post more

- Jouni

itmanager2 · ‎10-09-2013

Jouni,

Thank you for your assistance!

That worked, I'm not getting to the 10.0.1.0 subnet, but I can work around that.

Thank you again.

Jerry

Jouni Forss · ‎10-09-2013

Hi,

Great to hear that it works.

I think you should be able to get to the network directly connected to the ASA "inside" also.

Naturally you can try if a new "nat" configuration would help at all

object network INSIDE

subnet 10.0.1.0 255.255.255.0

nat (inside,outside) 1 source static INSIDE INSIDE destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

If it still doesnt work we could always check the NAT configurations again and also take "packet-tracer" command output to see if there is any problem on the ASA itself

For example when you are connected with VPN client you could issue the command

packet-tracer input outside icmp 8 0 10.0.1.100

This should show which rules/configuration are applied to this connection that is not working. Just insert the IP address that your VPN Client gets. The destination IP address in the above command is just an example. It doesnt really matter what it is as long as its part of the network/subnet to which we simulate/test traffic.

- Jouni

itmanager2 · ‎10-09-2013

Jouni,

Here is the packet tracer. I added the NAT you suggested but it didn't work. If possible I would like to get the Split Tunnel setup so the VPN computer can get to the internet (currently it isn't working and I tried to setup the Split Tunnel using the ASDM). I removed the Split Tunnel change and cleared the xlate and ran the packet tracer (the PING to the INSIDE network still didn't work - the INSIDE _Hosts is working.

Thank you again for all of your assistance.

Jerry

******************************

mxfw(config)# packet-tracer input outside icmp 192.168.60.20 8 0 10.0.1.100 de$

Phase: 1

Type: CAPTURE

Subtype:

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xad054768, priority=13, domain=capture, deny=false

hits=330478, user_data=0xad23fec0, cs_id=0x0, l3_type=0x0

src mac=0000.0000.0000, mask=0000.0000.0000

dst mac=0000.0000.0000, mask=0000.0000.0000

input_ifc=outside, output_ifc=any

Phase: 2

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in id=0xac751378, priority=1, domain=permit, deny=false

hits=164957, user_data=0x0, cs_id=0x0, l3_type=0x8

src mac=0000.0000.0000, mask=0000.0000.0000

dst mac=0000.0000.0000, mask=0100.0000.0000

input_ifc=outside, output_ifc=any

Phase: 3

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 10.0.1.0 255.255.255.0 inside

Phase: 4

Type: UN-NAT

Subtype: static

Result: ALLOW

Config:

nat (inside,outside) source static INSIDE INSIDE destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

Additional Information:

NAT divert to egress interface inside

Untranslate 10.0.1.100/0 to 10.0.1.100/0

Phase: 5

Type: ACCESS-LIST

Subtype:

Result: DROP

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in id=0xac7519f8, priority=0, domain=permit, deny=true

hits=486, user_data=0x9, cs_id=0x0, use_real_addr, flags=0x1000, protocol=0

src ip/id=0.0.0.0, mask=0.0.0.0, port=0

dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

input_ifc=outside, output_ifc=any

Result:

input-interface: outside

input-status: up

input-line-status: up

output-interface: inside

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule

Jouni Forss · ‎10-09-2013

Hi,

It seems to drop on ACL check but I am not quite sure why it would

You have the default setting which doesnt require interface ACL check for traffic coming from a VPN Connection. You dont have any problems related to the "security-level" configuration on the ASA either.

For the Split Tunnel you could configure this

access-list SPLIT-TUNNEL standard permit 10.0.1.0 255.255.255.0

access-list SPLIT-TUNNEL standard permit 10.1.00 255.255.0.0

group-policy GroupPolicy_AnyConnect attributes

split-tunnel-policy tunnelspecified

split-tunnel-network-list value SPLIT-TUNNEL

Though after this the NAT configuration above is useless as Internet bound traffic should not arrive to the ASA anymore from the VPN client.

- Jouni

itmanager2 · ‎10-09-2013

Jouni,

The current config is included below.

I added the SPLIT-TUNNEL but it still isn't working and neither is the INSIDE - but I can work around that issue as I said.

If you notcie anything, let me know.

Thank you again,

Jerry

******************************************

ASA Version 8.4(4)

!

hostname mxfw

domain-name moxiefl.com

enable password $$$$$$$$$$$$$$$$$$$ encrypted

!

names

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

shutdown

!

interface Ethernet0/4

shutdown

!

interface Ethernet0/5

switchport trunk allowed vlan 20,22

switchport mode trunk

!

interface Ethernet0/6

shutdown

!

interface Ethernet0/7

shutdown

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

!

interface Vlan20

nameif dmz

security-level 50

ip address 172.26.20.1 255.255.255.0

!

interface Vlan22

nameif dmz2

security-level 50

ip address 172.26.22.1 255.255.255.0

!

ftp mode passive

dns domain-lookup inside

dns domain-lookup outside

dns server-group DefaultDNS

name-server 208.67.222.222

name-server 208.67.220.220

domain-name moxiefl.com

same-security-traffic permit inter-interface

object network Generic_All_Network

subnet 0.0.0.0 0.0.0.0

object network INSIDE_Hosts

subnet 10.1.0.0 255.255.0.0

object network AnyConnect_Hosts

subnet 192.168.60.0 255.255.255.0

object network NETWORK_OBJ_192.168.60.0_26

subnet 192.168.60.0 255.255.255.192

object network DMZ_Network

subnet 172.26.20.0 255.255.255.0

object network DMZ2_Network

subnet 172.26.22.0 255.255.255.0

object network INSIDE

subnet 10.0.1.0 255.255.255.0

access-list capdmz extended permit icmp host 172.26.20.22 host 208.67.222.222

access-list capdmz extended permit icmp host 208.67.222.222 host 172.26.20.22

access-list capout extended permit icmp host 192.168.1.231 host 208.67.222.222

access-list capout extended permit icmp host 208.67.222.222 host 192.168.1.231

access-list AnyConnect_Client_Local_Print extended deny ip any any

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd

access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631

access-list AnyConnect_Client_Local_Print remark Windows' printing port

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100

access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol

access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353

access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol

access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355

access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137

access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns

access-list SPLIT-TUNNEL standard permit 10.0.1.0 255.255.255.0

access-list SPLIT-TUNNEL standard permit 10.1.0.0 255.255.0.0

pager lines 24

mtu inside 1500

mtu outside 1500

mtu dmz 1500

mtu dmz2 1500

ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (inside,outside) source static INSIDE INSIDE destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.60.0_26 NETWORK_OBJ_192.168.60.0_26 no-proxy-arp route-lookup

nat (dmz,outside) source dynamic Generic_All_Network interface

nat (dmz2,outside) source dynamic Generic_All_Network interface

!

nat (inside,outside) after-auto source dynamic Generic_All_Network interface