Solved: AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

itmanager2 · ‎10-08-2013

My AnyConnect VPN connect to the ASA, however I cannot access my inside network hosts (tried Split Tunnel and it didn't work either). I plan to use a Split Tunnel configuration but I thought I would get this working before I implemented that configuration. My inside hosts are on a 10.0.1.0/24 network and 10.1.0.0/16 networks. My AnyConnect hosts are using 192.168.60.0/24 addresses.

I have seen other people that appeared to have similar posts but none of those solutions have worked for me. I have also tried several NAT and ACL configurations to allow traffic form my Inside network to the ANYConnect hosts and back, but apparently I did it incorrectly. I undestand that this ver 8.4 is supposed to be easier to perform NAT and such, but I now in the router IOS it was much simpler.

My configuration is included below.

Thank you in advance for your assistance.

Jerry

*************************************************************

ASA Version 8.4(4)

!

hostname mxfw

domain-name moxiefl.com

enable password (removed)

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

shutdown

!

interface Ethernet0/4

shutdown

!

interface Ethernet0/5

switchport trunk allowed vlan 20,22

switchport mode trunk

!

interface Ethernet0/6

shutdown

!

interface Ethernet0/7

shutdown

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

!

interface Vlan20

nameif dmz

security-level 50

ip address 172.26.20.1 255.255.255.0

!

interface Vlan22

nameif dmz2

security-level 50

ip address 172.26.22.1 255.255.255.0

!

ftp mode passive

dns domain-lookup inside

dns domain-lookup outside

dns server-group DefaultDNS

name-server 208.67.222.222

name-server 208.67.220.220

domain-name moxiefl.com

same-security-traffic permit inter-interface

object network Generic_All_Network

subnet 0.0.0.0 0.0.0.0

object network INSIDE_Hosts

subnet 10.1.0.0 255.255.0.0

object network AnyConnect_Hosts

subnet 192.168.60.0 255.255.255.0

object network NETWORK_OBJ_192.168.60.0_26

subnet 192.168.60.0 255.255.255.192

object network DMZ_Network

subnet 172.26.20.0 255.255.255.0

object network DMZ2_Network

subnet 172.26.22.0 255.255.255.0

pager lines 24

mtu inside 1500

mtu outside 1500

mtu dmz 1500

mtu dmz2 1500

ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (inside,outside) source dynamic Generic_All_Network interface

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.60.0_26 NETWORK_OBJ_192.168.60.0_26 no-proxy-arp route-lookup

nat (dmz,outside) source dynamic Generic_All_Network interface

nat (dmz2,outside) source dynamic Generic_All_Network interface

route inside 10.1.0.0 255.255.0.0 10.0.1.2 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

http server enable

http 10.0.0.0 255.0.0.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec ikev2 ipsec-proposal AES256

protocol esp encryption aes-256

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES192

protocol esp encryption aes-192

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES

protocol esp encryption aes

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal 3DES

protocol esp encryption 3des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal DES

protocol esp encryption des

protocol esp integrity sha-1 md5

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto ca trustpoint ASDM_TrustPoint0

enrollment self

fqdn anyconnect.moxiefl.com

subject-name CN=AnyConnect.moxiefl.com

keypair AnyConnect

proxy-ldc-issuer

crl configure

crypto ca certificate chain ASDM_TrustPoint0

certificate 439a4452

3082026c 308201d5 a0030201 02020443 9a445230 0d06092a 864886f7 0d010105

05003048 311f301d 06035504 03131641 6e79436f 6e6e6563 742e6d6f 78696566

6c2e636f 6d312530 2306092a 864886f7 0d010902 1616616e 79636f6e 6e656374

2e6d6f78 6965666c 2e636f6d 301e170d 31333039 32373037 32353331 5a170d32

33303932 35303732 3533315a 3048311f 301d0603 55040313 16416e79 436f6e6e

6563742e 6d6f7869 65666c2e 636f6d31 25302306 092a8648 86f70d01 09021616

616e7963 6f6e6e65 63742e6d 6f786965 666c2e63 6f6d3081 9f300d06 092a8648

86f70d01 01010500 03818d00 30818902 8181009a d9f320ff e93d4fdd cb707a4c

b4664c47 6d2cc639 4dc45fed bfbc2150 7109fd81 5d6a5252 3d40dc43 696360d5

fbf92bcc 477d19b8 5301085c daf40de5 87d7e4aa f81b8d7f 8d364dfa 0a6f07d7

6a7c3e9b 56e69152 aa5492d8 e35537bd 567ccf29 7afbeae8 13da9936 9f890d76

1d56d11d da3d039a 0e714849 e6841ff2 5483b102 03010001 a3633061 300f0603

551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06

03551d23 04183016 80142f27 7096c4c5 e396e691 e07ef737 af61b71f 64f1301d

0603551d 0e041604 142f2770 96c4c5e3 96e691e0 7ef737af 61b71f64 f1300d06

092a8648 86f70d01 01050500 03818100 8f777196 bbe6a5e4 8af9eb9a 514a8348

5e62d6cd 47257243 e430a758 2b367543 065d4ceb 582bf666 08ff7be1 f89287a2

ac527824 b11c2048 7fd2b50d 35ca3902 6aa00675 e4df7859 f3590596 b1d52426

1e97a52c 4e77f4b0 226dec09 713f7ba9 80bdf7bb b52a7da2 4a68b91b 455cabba

0cc4c6f3 f244f7d9 0a6e32fb 31ce7e35

quit

crypto ikev2 policy 1

encryption aes-256

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 10

encryption aes-192

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 20

encryption aes

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 30

encryption 3des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 40

encryption des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 enable outside client-services port 443

crypto ikev2 remote-access trustpoint ASDM_TrustPoint0

telnet timeout 5

ssh 10.0.0.0 255.0.0.0 inside

ssh timeout 5

ssh key-exchange group dh-group1-sha1

console timeout 0

dhcpd dns 208.67.222.222 208.67.220.220

dhcpd auto_config outside

!

dhcpd address 10.0.1.20-10.0.1.40 inside

dhcpd dns 208.67.222.222 208.67.220.220 interface inside

dhcpd enable inside

!

dhcpd address 172.26.20.21-172.26.20.60 dmz

dhcpd dns 208.67.222.222 208.67.220.220 interface dmz

dhcpd enable dmz

!

dhcpd address 172.26.22.21-172.26.22.200 dmz2

dhcpd dns 208.67.222.222 208.67.220.220 interface dmz2

dhcpd enable dmz2

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ssl trust-point ASDM_TrustPoint0 outside

webvpn

enable outside

anyconnect-essentials

anyconnect image disk0:/anyconnect-win-3.0.2052-k9.pkg 1

anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml

anyconnect enable

tunnel-group-list enable

group-policy GroupPolicy_AnyConnect internal

group-policy GroupPolicy_AnyConnect attributes

wins-server none

dns-server value 208.67.222.222 208.67.220.220

vpn-tunnel-protocol ikev2 ssl-client

default-domain value moxiefl.com

webvpn

anyconnect profiles value AnyConnect_client_profile type user

username user1 password $$$$$$$$$$$$$$$$$ encrypted privilege 15

username user2 password $$$$$$$$$$$$$$$$$ encrypted privilege 15

tunnel-group AnyConnect type remote-access

tunnel-group AnyConnect general-attributes

address-pool VPN_POOL

default-group-policy GroupPolicy_AnyConnect

tunnel-group AnyConnect webvpn-attributes

group-alias AnyConnect enable

!

class-map inspection_default

match default-inspection-traffic

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect ip-options

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

inspect icmp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

no active

destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

destination address email callhome@cisco.com

destination transport-method http

subscribe-to-alert-group diagnostic

subscribe-to-alert-group environment

subscribe-to-alert-group inventory periodic monthly

subscribe-to-alert-group configuration periodic monthly

subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:f2c7362097b71bcada023c6bbfc45121

: end

Jouni Forss · ‎10-08-2013

Hi,

You might have problem with the NAT configurations

Look at these 2 top configurations

nat (inside,outside) source dynamic Generic_All_Network interface

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

The solution is either to configure the Dynamic PAT again with lower priority (will tear down current normal outbound connections) OR reposition the NAT Exempt / NAT0 configurations

Dynamic PAT change could be done with

no nat (inside,outside) source dynamic Generic_All_Network interface

nat (inside,outside) after-auto source dynamic Generic_All_Network interface

NAT0 configuration change could be done with

no nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

nat (inside,outside) 1 source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

Changing the order of the NAT0 configurations like described above is probably the easiest solution and doesnt cause a teardown of connections for the users. Naturally changing the Dynamic PAT configuration would prevent any future problems that it might cause. It might for example overide Static PAT (Port Forward) configurations configured with Auto NAT.

Try whichever option suites you the best and let us know if it solved the problem

Please do remember to mark a reply as the correct answer if it answered your question.

Feel free to ask more if needed

- Jouni

View solution in original post

Jouni Forss · ‎10-08-2013

Hi,

You might have problem with the NAT configurations

Look at these 2 top configurations

nat (inside,outside) source dynamic Generic_All_Network interface

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

The solution is either to configure the Dynamic PAT again with lower priority (will tear down current normal outbound connections) OR reposition the NAT Exempt / NAT0 configurations

Dynamic PAT change could be done with

no nat (inside,outside) source dynamic Generic_All_Network interface

nat (inside,outside) after-auto source dynamic Generic_All_Network interface

NAT0 configuration change could be done with

no nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

nat (inside,outside) 1 source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

Changing the order of the NAT0 configurations like described above is probably the easiest solution and doesnt cause a teardown of connections for the users. Naturally changing the Dynamic PAT configuration would prevent any future problems that it might cause. It might for example overide Static PAT (Port Forward) configurations configured with Auto NAT.

Try whichever option suites you the best and let us know if it solved the problem

Please do remember to mark a reply as the correct answer if it answered your question.

Feel free to ask more if needed

- Jouni

itmanager2 · ‎10-08-2013

Jouni,

Thank you for the input. I will be back at the equipment tomorrow morning and will try the Dynamic PAT solution (I will need to add some port forwarding in the future as well, but waiting until I get other items ironed out).

When doing the Dynamic PAT, should I remove the

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

command as well, or leave it in the configuration?

Thank you agin for your assistance, I will let you know how it goes tomorrow.

Jerry

Jouni Forss · ‎10-08-2013

Hi,

If you are doing to remove the Dynamic PAT and enter it with the lower priority then you WONT have to touch the existing "nat" configuration for the VPN users.

The reason is that since you have already changed the Dynamic PAT configuration it will mean that it wont be overriding the above mentioned VPN "nat" configuration anymore and it should be working just fine without changes.

- Jouni

itmanager2 · ‎10-09-2013

Jouni,

Well I forgot to test one item, I cannot get to the internet with this configuration from the AnyConnect computer. I tried turning on Split Tunneling as well and that didn't work either.

The current config is below (includes some troubleshooting items for a DMZ to internet issue).

Thank you again for your help!

Jerry

*****************************************************

ASA Version 8.4(4)

!

hostname mxfw

domain-name moxiefl.com

enable password $$$$$$$$$$$$$$$ encrypted

!

names

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

shutdown

!

interface Ethernet0/4

shutdown

!

interface Ethernet0/5

switchport trunk allowed vlan 20,22

switchport mode trunk

!

interface Ethernet0/6

shutdown

!

interface Ethernet0/7

shutdown

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

!

interface Vlan20

nameif dmz

security-level 50

ip address 172.26.20.1 255.255.255.0

!

interface Vlan22

nameif dmz2

security-level 50

ip address 172.26.22.1 255.255.255.0

!

ftp mode passive

dns domain-lookup inside

dns domain-lookup outside

dns server-group DefaultDNS

name-server 208.67.222.222

name-server 208.67.220.220

domain-name moxiefl.com

same-security-traffic permit inter-interface

object network Generic_All_Network

subnet 0.0.0.0 0.0.0.0

object network INSIDE_Hosts

subnet 10.1.0.0 255.255.0.0

object network AnyConnect_Hosts

subnet 192.168.60.0 255.255.255.0

object network NETWORK_OBJ_192.168.60.0_26

subnet 192.168.60.0 255.255.255.192

object network DMZ_Network

subnet 172.26.20.0 255.255.255.0

object network DMZ2_Network

subnet 172.26.22.0 255.255.255.0

access-list capdmz extended permit icmp host 172.26.20.21 host 208.67.222.222

access-list capdmz extended permit icmp host 208.67.222.222 host 172.26.20.21

access-list capout extended permit icmp host 192.168.1.231 host 208.67.222.222

access-list capout extended permit icmp host 208.67.222.222 host 192.168.1.231

access-list NAT_Exempt_VPN_Inside extended permit ip object AnyConnect_Hosts object INSIDE_Hosts

access-list NAT_Exempt_VPN_Inside extended permit ip object AnyConnect_Hosts 10.0.1.0 255.255.255.0

access-list AnyConnect_Client_Local_Print extended deny ip any any

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd

access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631

access-list AnyConnect_Client_Local_Print remark Windows' printing port

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100

access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol

access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353

access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol

access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355

access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137

access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns

pager lines 24

mtu inside 1500

mtu outside 1500

mtu dmz 1500

mtu dmz2 1500

ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.60.0_26 NETWORK_OBJ_192.168.60.0_26 no-proxy-arp route-lookup

nat (dmz,outside) source dynamic Generic_All_Network interface

nat (dmz2,outside) source dynamic Generic_All_Network interface

!

nat (inside,outside) after-auto source dynamic Generic_All_Network interface