Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside network

My AnyConnect VPN connect to the ASA, however I cannot access my inside network hosts (tried Split Tunnel and it didn't work either). I plan to use a Split Tunnel configuration but I thought I would get this working before I implemented that configuration. My inside hosts are on a 10.0.1.0/24 network and 10.1.0.0/16 networks. My AnyConnect hosts are using 192.168.60.0/24 addresses.

I have seen other people that appeared to have similar posts but none of those solutions have worked for me.  I have also tried several NAT and ACL configurations to allow traffic form my Inside network to the ANYConnect hosts and back, but apparently I did it incorrectly.  I undestand that this ver 8.4 is supposed to be easier to perform NAT and such, but I now in the router IOS it was much simpler.

My configuration is included below.

Thank you in advance for your assistance.

Jerry

*************************************************************

ASA Version 8.4(4)

!

hostname mxfw

domain-name moxiefl.com

enable password (removed)

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

shutdown

!

interface Ethernet0/4

shutdown

!

interface Ethernet0/5

switchport trunk allowed vlan 20,22

switchport mode trunk

!

interface Ethernet0/6

shutdown

!

interface Ethernet0/7

shutdown

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

!

interface Vlan20

nameif dmz

security-level 50

ip address 172.26.20.1 255.255.255.0

!

interface Vlan22

nameif dmz2

security-level 50

ip address 172.26.22.1 255.255.255.0

!

ftp mode passive

dns domain-lookup inside

dns domain-lookup outside

dns server-group DefaultDNS

name-server 208.67.222.222

name-server 208.67.220.220

domain-name moxiefl.com

same-security-traffic permit inter-interface

object network Generic_All_Network

subnet 0.0.0.0 0.0.0.0

object network INSIDE_Hosts

subnet 10.1.0.0 255.255.0.0

object network AnyConnect_Hosts

subnet 192.168.60.0 255.255.255.0

object network NETWORK_OBJ_192.168.60.0_26

subnet 192.168.60.0 255.255.255.192

object network DMZ_Network

subnet 172.26.20.0 255.255.255.0

object network DMZ2_Network

subnet 172.26.22.0 255.255.255.0

pager lines 24

mtu inside 1500

mtu outside 1500

mtu dmz 1500

mtu dmz2 1500

ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (inside,outside) source dynamic Generic_All_Network interface

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.60.0_26 NETWORK_OBJ_192.168.60.0_26 no-proxy-arp route-lookup

nat (dmz,outside) source dynamic Generic_All_Network interface

nat (dmz2,outside) source dynamic Generic_All_Network interface

route inside 10.1.0.0 255.255.0.0 10.0.1.2 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

http server enable

http 10.0.0.0 255.0.0.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec ikev2 ipsec-proposal AES256

protocol esp encryption aes-256

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES192

protocol esp encryption aes-192

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES

protocol esp encryption aes

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal 3DES

protocol esp encryption 3des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal DES

protocol esp encryption des

protocol esp integrity sha-1 md5

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto ca trustpoint ASDM_TrustPoint0

enrollment self

fqdn anyconnect.moxiefl.com

subject-name CN=AnyConnect.moxiefl.com

keypair AnyConnect

proxy-ldc-issuer

crl configure

crypto ca certificate chain ASDM_TrustPoint0

certificate 439a4452

    3082026c 308201d5 a0030201 02020443 9a445230 0d06092a 864886f7 0d010105

    05003048 311f301d 06035504 03131641 6e79436f 6e6e6563 742e6d6f 78696566

    6c2e636f 6d312530 2306092a 864886f7 0d010902 1616616e 79636f6e 6e656374

    2e6d6f78 6965666c 2e636f6d 301e170d 31333039 32373037 32353331 5a170d32

    33303932 35303732 3533315a 3048311f 301d0603 55040313 16416e79 436f6e6e

    6563742e 6d6f7869 65666c2e 636f6d31 25302306 092a8648 86f70d01 09021616

    616e7963 6f6e6e65 63742e6d 6f786965 666c2e63 6f6d3081 9f300d06 092a8648

    86f70d01 01010500 03818d00 30818902 8181009a d9f320ff e93d4fdd cb707a4c

    b4664c47 6d2cc639 4dc45fed bfbc2150 7109fd81 5d6a5252 3d40dc43 696360d5

    fbf92bcc 477d19b8 5301085c daf40de5 87d7e4aa f81b8d7f 8d364dfa 0a6f07d7

    6a7c3e9b 56e69152 aa5492d8 e35537bd 567ccf29 7afbeae8 13da9936 9f890d76

    1d56d11d da3d039a 0e714849 e6841ff2 5483b102 03010001 a3633061 300f0603

    551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06

    03551d23 04183016 80142f27 7096c4c5 e396e691 e07ef737 af61b71f 64f1301d

    0603551d 0e041604 142f2770 96c4c5e3 96e691e0 7ef737af 61b71f64 f1300d06

    092a8648 86f70d01 01050500 03818100 8f777196 bbe6a5e4 8af9eb9a 514a8348

    5e62d6cd 47257243 e430a758 2b367543 065d4ceb 582bf666 08ff7be1 f89287a2

    ac527824 b11c2048 7fd2b50d 35ca3902 6aa00675 e4df7859 f3590596 b1d52426

    1e97a52c 4e77f4b0 226dec09 713f7ba9 80bdf7bb b52a7da2 4a68b91b 455cabba

    0cc4c6f3 f244f7d9 0a6e32fb 31ce7e35

  quit

crypto ikev2 policy 1

encryption aes-256

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 10

encryption aes-192

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 20

encryption aes

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 30

encryption 3des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 40

encryption des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 enable outside client-services port 443

crypto ikev2 remote-access trustpoint ASDM_TrustPoint0

telnet timeout 5

ssh 10.0.0.0 255.0.0.0 inside

ssh timeout 5

ssh key-exchange group dh-group1-sha1

console timeout 0

dhcpd dns 208.67.222.222 208.67.220.220

dhcpd auto_config outside

!

dhcpd address 10.0.1.20-10.0.1.40 inside

dhcpd dns 208.67.222.222 208.67.220.220 interface inside

dhcpd enable inside

!

dhcpd address 172.26.20.21-172.26.20.60 dmz

dhcpd dns 208.67.222.222 208.67.220.220 interface dmz

dhcpd enable dmz

!

dhcpd address 172.26.22.21-172.26.22.200 dmz2

dhcpd dns 208.67.222.222 208.67.220.220 interface dmz2

dhcpd enable dmz2

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ssl trust-point ASDM_TrustPoint0 outside

webvpn

enable outside

anyconnect-essentials

anyconnect image disk0:/anyconnect-win-3.0.2052-k9.pkg 1

anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml

anyconnect enable

tunnel-group-list enable

group-policy GroupPolicy_AnyConnect internal

group-policy GroupPolicy_AnyConnect attributes

wins-server none

dns-server value 208.67.222.222 208.67.220.220

vpn-tunnel-protocol ikev2 ssl-client

default-domain value moxiefl.com

webvpn

  anyconnect profiles value AnyConnect_client_profile type user

username user1 password $$$$$$$$$$$$$$$$$ encrypted privilege 15

username user2 password $$$$$$$$$$$$$$$$$ encrypted privilege 15

tunnel-group AnyConnect type remote-access

tunnel-group AnyConnect general-attributes

address-pool VPN_POOL

default-group-policy GroupPolicy_AnyConnect

tunnel-group AnyConnect webvpn-attributes

group-alias AnyConnect enable

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip

  inspect xdmcp

  inspect icmp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:f2c7362097b71bcada023c6bbfc45121

: end

Everyone's tags (2)
1 ACCEPTED SOLUTION

Accepted Solutions
Super Bronze

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Hi,

You might have problem with the NAT configurations

Look at these 2 top configurations

nat (inside,outside) source dynamic Generic_All_Network interface

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

The solution is either to configure the Dynamic PAT again with lower priority (will tear down current normal outbound connections) OR reposition the NAT Exempt / NAT0 configurations

Dynamic PAT change could be done with

no nat (inside,outside) source dynamic Generic_All_Network interface

nat (inside,outside) after-auto source dynamic Generic_All_Network interface


NAT0 configuration change could be done with

no nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

nat (inside,outside) 1 source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

Changing the order of the NAT0 configurations like described above is probably the easiest solution and doesnt cause a teardown of connections for the users. Naturally changing the Dynamic PAT configuration would prevent any future problems that it might cause. It might for example overide Static PAT (Port Forward) configurations configured with Auto NAT.

Try whichever option suites you the best and let us know if it solved the problem

Please do remember to mark a reply as the correct answer if it answered your question.

Feel free to ask more if needed

- Jouni

25 REPLIES
Super Bronze

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Hi,

You might have problem with the NAT configurations

Look at these 2 top configurations

nat (inside,outside) source dynamic Generic_All_Network interface

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

The solution is either to configure the Dynamic PAT again with lower priority (will tear down current normal outbound connections) OR reposition the NAT Exempt / NAT0 configurations

Dynamic PAT change could be done with

no nat (inside,outside) source dynamic Generic_All_Network interface

nat (inside,outside) after-auto source dynamic Generic_All_Network interface


NAT0 configuration change could be done with

no nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

nat (inside,outside) 1 source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

Changing the order of the NAT0 configurations like described above is probably the easiest solution and doesnt cause a teardown of connections for the users. Naturally changing the Dynamic PAT configuration would prevent any future problems that it might cause. It might for example overide Static PAT (Port Forward) configurations configured with Auto NAT.

Try whichever option suites you the best and let us know if it solved the problem

Please do remember to mark a reply as the correct answer if it answered your question.

Feel free to ask more if needed

- Jouni

New Member

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Jouni,

Thank you for the input. I will be back at the equipment tomorrow morning and will try the Dynamic PAT solution (I will need to add some port forwarding in the future as well, but waiting until I get other items ironed out).

When doing the Dynamic PAT, should I remove the

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

command as well, or leave it in the configuration?

Thank you agin for your assistance, I will let you know how it goes tomorrow.

Jerry

Super Bronze

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Hi,

If you are doing to remove the Dynamic PAT and enter it with the lower priority then you WONT have to touch the existing "nat" configuration for the VPN users.

The reason is that since you have already changed the Dynamic PAT configuration it will mean that it wont be overriding the above mentioned VPN "nat" configuration anymore and it should be working just fine without changes.

- Jouni

New Member

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Jouni,

Well I forgot to test one item, I cannot get to the internet with this configuration from the AnyConnect computer.  I tried turning on Split Tunneling as well and that didn't work either.

The current config is below (includes some troubleshooting items for a DMZ to internet issue).

Thank you again for your help!

Jerry

*****************************************************

ASA Version 8.4(4)

!

hostname mxfw

domain-name moxiefl.com

enable password $$$$$$$$$$$$$$$ encrypted

!

names

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

shutdown

!

interface Ethernet0/4

shutdown

!

interface Ethernet0/5

switchport trunk allowed vlan 20,22

switchport mode trunk

!

interface Ethernet0/6

shutdown

!

interface Ethernet0/7

shutdown

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

!

interface Vlan20

nameif dmz

security-level 50

ip address 172.26.20.1 255.255.255.0

!

interface Vlan22

nameif dmz2

security-level 50

ip address 172.26.22.1 255.255.255.0

!

ftp mode passive

dns domain-lookup inside

dns domain-lookup outside

dns server-group DefaultDNS

name-server 208.67.222.222

name-server 208.67.220.220

domain-name moxiefl.com

same-security-traffic permit inter-interface

object network Generic_All_Network

subnet 0.0.0.0 0.0.0.0

object network INSIDE_Hosts

subnet 10.1.0.0 255.255.0.0

object network AnyConnect_Hosts

subnet 192.168.60.0 255.255.255.0

object network NETWORK_OBJ_192.168.60.0_26

subnet 192.168.60.0 255.255.255.192

object network DMZ_Network

subnet 172.26.20.0 255.255.255.0

object network DMZ2_Network

subnet 172.26.22.0 255.255.255.0

access-list capdmz extended permit icmp host 172.26.20.21 host 208.67.222.222

access-list capdmz extended permit icmp host 208.67.222.222 host 172.26.20.21

access-list capout extended permit icmp host 192.168.1.231 host 208.67.222.222

access-list capout extended permit icmp host 208.67.222.222 host 192.168.1.231

access-list NAT_Exempt_VPN_Inside extended permit ip object AnyConnect_Hosts object INSIDE_Hosts

access-list NAT_Exempt_VPN_Inside extended permit ip object AnyConnect_Hosts 10.0.1.0 255.255.255.0

access-list AnyConnect_Client_Local_Print extended deny ip any any

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd

access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631

access-list AnyConnect_Client_Local_Print remark Windows' printing port

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100

access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol

access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353

access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol

access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355

access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137

access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns

pager lines 24

mtu inside 1500

mtu outside 1500

mtu dmz 1500

mtu dmz2 1500

ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.60.0_26 NETWORK_OBJ_192.168.60.0_26 no-proxy-arp route-lookup

nat (dmz,outside) source dynamic Generic_All_Network interface

nat (dmz2,outside) source dynamic Generic_All_Network interface

!

nat (inside,outside) after-auto source dynamic Generic_All_Network interface

route inside 10.1.0.0 255.255.0.0 10.0.1.2 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

http server enable

http 10.0.0.0 255.0.0.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec ikev2 ipsec-proposal DES

protocol esp encryption des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal 3DES

protocol esp encryption 3des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES

protocol esp encryption aes

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES192

protocol esp encryption aes-192

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES256

protocol esp encryption aes-256

protocol esp integrity sha-1 md5

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto ca trustpoint ASDM_TrustPoint0

enrollment self

fqdn anyconnect.moxiefl.com

subject-name CN=AnyConnect.moxiefl.com

keypair AnyConnect

proxy-ldc-issuer

crl configure

crypto ca certificate chain ASDM_TrustPoint0

certificate 439a4452

    3082026c 308201d5 a0030201 02020443 9a445230 0d06092a 864886f7 0d010105

    05003048 311f301d 06035504 03131641 6e79436f 6e6e6563 742e6d6f 78696566

    6c2e636f 6d312530 2306092a 864886f7 0d010902 1616616e 79636f6e 6e656374

    2e6d6f78 6965666c 2e636f6d 301e170d 31333039 32373037 32353331 5a170d32

    33303932 35303732 3533315a 3048311f 301d0603 55040313 16416e79 436f6e6e

    6563742e 6d6f7869 65666c2e 636f6d31 25302306 092a8648 86f70d01 09021616

    616e7963 6f6e6e65 63742e6d 6f786965 666c2e63 6f6d3081 9f300d06 092a8648

    86f70d01 01010500 03818d00 30818902 8181009a d9f320ff e93d4fdd cb707a4c

    b4664c47 6d2cc639 4dc45fed bfbc2150 7109fd81 5d6a5252 3d40dc43 696360d5

    fbf92bcc 477d19b8 5301085c daf40de5 87d7e4aa f81b8d7f 8d364dfa 0a6f07d7

    6a7c3e9b 56e69152 aa5492d8 e35537bd 567ccf29 7afbeae8 13da9936 9f890d76

    1d56d11d da3d039a 0e714849 e6841ff2 5483b102 03010001 a3633061 300f0603

    551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06

    03551d23 04183016 80142f27 7096c4c5 e396e691 e07ef737 af61b71f 64f1301d

    0603551d 0e041604 142f2770 96c4c5e3 96e691e0 7ef737af 61b71f64 f1300d06

    092a8648 86f70d01 01050500 03818100 8f777196 bbe6a5e4 8af9eb9a 514a8348

    5e62d6cd 47257243 e430a758 2b367543 065d4ceb 582bf666 08ff7be1 f89287a2

    ac527824 b11c2048 7fd2b50d 35ca3902 6aa00675 e4df7859 f3590596 b1d52426

    1e97a52c 4e77f4b0 226dec09 713f7ba9 80bdf7bb b52a7da2 4a68b91b 455cabba

    0cc4c6f3 f244f7d9 0a6e32fb 31ce7e35

  quit

crypto ikev2 policy 1

encryption aes-256

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 10

encryption aes-192

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 20

encryption aes

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 30

encryption 3des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 40

encryption des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 enable outside client-services port 443

crypto ikev2 remote-access trustpoint ASDM_TrustPoint0

telnet timeout 5

ssh 10.0.0.0 255.0.0.0 inside

ssh timeout 5

ssh key-exchange group dh-group1-sha1

console timeout 0

dhcpd dns 208.67.222.222 208.67.220.220

dhcpd auto_config outside

!

dhcpd address 10.0.1.20-10.0.1.40 inside

dhcpd dns 208.67.222.222 208.67.220.220 interface inside

dhcpd enable inside

!

dhcpd address 172.26.20.21-172.26.20.60 dmz

dhcpd dns 208.67.222.222 208.67.220.220 interface dmz

dhcpd enable dmz

!

dhcpd address 172.26.22.21-172.26.22.200 dmz2

dhcpd dns 208.67.222.222 208.67.220.220 interface dmz2

dhcpd enable dmz2

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ssl trust-point ASDM_TrustPoint0 outside

webvpn

enable outside

anyconnect-essentials

anyconnect image disk0:/anyconnect-win-3.0.2052-k9.pkg 1

anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml

anyconnect enable

tunnel-group-list enable

group-policy GroupPolicy_AnyConnect internal

group-policy GroupPolicy_AnyConnect attributes

wins-server none

dns-server value 208.67.222.222 208.67.220.220

vpn-tunnel-protocol ikev2 ssl-client

split-tunnel-policy excludespecified

split-tunnel-network-list value NAT_Exempt_VPN_Inside

default-domain value moxiefl.com

webvpn

  anyconnect profiles value AnyConnect_client_profile type user

username user1 password $$$$$$$$$$$$$$$$$ encrypted privilege 15

username user2 password $$$$$$$$$$$$$$$$$ encrypted privilege 15

tunnel-group AnyConnect type remote-access

tunnel-group AnyConnect general-attributes

address-pool VPN_POOL

default-group-policy GroupPolicy_AnyConnect

tunnel-group AnyConnect webvpn-attributes

group-alias AnyConnect enable

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip

  inspect xdmcp

  inspect icmp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:4e23485b62cbedf8a04350a64878be52

: end

Super Bronze

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Hi.

With Full Tunnel configuration try these additions to ASA

same-security-traffic permit intra-interface

nat (outside,outside) after-auto source dynamic AnyConnect_Hosts interface

This should enable VPN user to use the ASA "outside" interface for Internet connections

- Jouni

New Member

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Jouni,

I have to head home because I work tonight again. I will have time towork on this again tomorrow.  I wasn't able to get the capture to capture any of the pings.  I will try again tomorrow.  It is interesting that I can ping the gateway but not the computer on the L3 switch.  I will verify that routing (I set it as static 0.0.0.0 0.0.0.0 to the ASA but need to verify).

Thank you,

Jerry

Super Bronze

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Hi,

It seems you are still missing this from under the "group-policy"

split-tunnel-policy tunnelspecified

I think that should activate the Split Tunnel together with the existing command that defines the ACL

You could also check the routing section from the AnyConnect Client software while the VPN is active so we see that it lists only the required networks.

You can also use the Windows hosts command prompt and issue "route print" to show the computers routing table

- Jouni

New Member

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Jouni,

That fixed the split tunnel. I still can't ping past the 10.1.10.1 gateway on the L3 switch.

Here is the route print for the VPN computer:

C:\Users\Jerry>route print

===========================================================================

Interface List

15...00 05 9a 3c 7a 00 ......Cisco AnyConnect Secure Mobility Client Virtual Mi

niport Adapter for Windows x64

16...50 b7 c3 58 fd c6 ......Atheros AR9485WB-EG Wireless Network Adapter

12...b8 88 e3 fd 0b 90 ......Realtek PCIe GBE Family Controller

  1...........................Software Loopback Interface 1

19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter

18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2

11...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface

31...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3

===========================================================================

IPv4 Route Table

===========================================================================

Active Routes:

Network Destination        Netmask          Gateway       Interface  Metric

          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.128     25

         10.0.1.0    255.255.255.0         On-link     192.168.60.20      2

       10.0.1.255  255.255.255.255         On-link     192.168.60.20    257

         10.1.0.0      255.255.0.0         On-link     192.168.60.20      2

     10.1.255.255  255.255.255.255         On-link     192.168.60.20    257

     66.177.37.37  255.255.255.255      192.168.1.1    192.168.1.128     26

        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306

        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306

  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306

      192.168.1.0    255.255.255.0         On-link     192.168.1.128    281

      192.168.1.1  255.255.255.255      192.168.1.1    192.168.1.128     26

    192.168.1.128  255.255.255.255         On-link     192.168.1.128    281

    192.168.1.255  255.255.255.255         On-link     192.168.1.128    281

     192.168.60.0    255.255.255.0         On-link     192.168.60.20    257

    192.168.60.20  255.255.255.255         On-link     192.168.60.20    257

   192.168.60.255  255.255.255.255         On-link     192.168.60.20    257

        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306

        224.0.0.0        240.0.0.0         On-link     192.168.1.128    281

        224.0.0.0        240.0.0.0         On-link     192.168.60.20  10000

  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306

  255.255.255.255  255.255.255.255         On-link     192.168.1.128    281

  255.255.255.255  255.255.255.255         On-link     192.168.60.20    257

===========================================================================

Persistent Routes:

  Network Address          Netmask  Gateway Address  Metric

          0.0.0.0          0.0.0.0      172.26.20.1  Default

===========================================================================

IPv6 Route Table

===========================================================================

Active Routes:

If Metric Network Destination      Gateway

11     58 ::/0                     On-link

  1    306 ::1/128                  On-link

11    306 2001:0:9d38:6ab8:1c1e:35a4:3f57:fe7f/128

                                    On-link

15    281 fe80::84e:def9:e6ef:4d16/128

                                    On-link

11    306 fe80::1c1e:35a4:3f57:fe7f/128

                                    On-link

16    281 fe80::707e:b3a7:acea:cbf9/128

                                    On-link

  1    306 ff00::/8                 On-link

11    306 ff00::/8                 On-link

16    281 ff00::/8                 On-link

15    281 ff00::/8                 On-link

===========================================================================

Persistent Routes:

  None

********************************************************************************************************************************

This is the route print for the PC 10.1.10.23:

C:\Users\Moxie-Admin>route print

===========================================================================

Interface List

14...68 94 23 20 fa c5 ......Microsoft Wi-Fi Direct Virtual Adapter

13...68 94 23 20 fa c3 ......Ralink RT5390R 802.11bgn Wi-Fi Adapter

12...08 9e 01 3d 64 39 ......Realtek PCIe FE Family Controller

  1...........................Software Loopback Interface 1

15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter

16...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface

===========================================================================

IPv4 Route Table

===========================================================================

Active Routes:

Network Destination        Netmask          Gateway       Interface  Metric

          0.0.0.0          0.0.0.0        10.1.10.1       10.1.10.23     20

        10.1.10.0    255.255.255.0         On-link        10.1.10.23    276

       10.1.10.23  255.255.255.255         On-link        10.1.10.23    276

      10.1.10.255  255.255.255.255         On-link        10.1.10.23    276

        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306

        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306

  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306

        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306

        224.0.0.0        240.0.0.0         On-link        10.1.10.23    276

  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306

  255.255.255.255  255.255.255.255         On-link        10.1.10.23    276

===========================================================================

Persistent Routes:

  None

IPv6 Route Table

===========================================================================

Active Routes:

If Metric Network Destination      Gateway

16    306 ::/0                     On-link

  1    306 ::1/128                  On-link

16    306 2001::/32                On-link

16    306 2001:0:5ef5:79fd:28e7:13b2:f5fe:f5e8/128

                                    On-link

16    306 fe80::/64                On-link

16    306 fe80::28e7:13b2:f5fe:f5e8/128

                                    On-link

  1    306 ff00::/8                 On-link

16    306 ff00::/8                 On-link

===========================================================================

Persistent Routes:

  None

*******************************************************************************************************************************

Here is the packet-tracer for the outside going to the inside for the VPN to the computer:

mxfw(config)# packet-tracer input outside icmp 192.168.60.20 8 0 10.1.10.23 de$

Phase: 1

Type: CAPTURE

Subtype:

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in  id=0xad054768, priority=13, domain=capture, deny=false

        hits=2159484, user_data=0xad23fec0, cs_id=0x0, l3_type=0x0

        src mac=0000.0000.0000, mask=0000.0000.0000

        dst mac=0000.0000.0000, mask=0000.0000.0000

        input_ifc=outside, output_ifc=any

Phase: 2

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in  id=0xac751378, priority=1, domain=permit, deny=false

        hits=1073479, user_data=0x0, cs_id=0x0, l3_type=0x8

        src mac=0000.0000.0000, mask=0000.0000.0000

        dst mac=0000.0000.0000, mask=0100.0000.0000

        input_ifc=outside, output_ifc=any

Phase: 3

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in   10.1.0.0        255.255.0.0     inside

Phase: 4

Type: UN-NAT

Subtype: static

Result: ALLOW

Config:

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

Additional Information:

NAT divert to egress interface inside

Untranslate 10.1.10.23/0 to 10.1.10.23/0

Phase: 5

Type: ACCESS-LIST

Subtype:

Result: DROP

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in  id=0xac7519f8, priority=0, domain=permit, deny=true

        hits=720, user_data=0x9, cs_id=0x0, use_real_addr, flags=0x1000, protocol=0

        src ip/id=0.0.0.0, mask=0.0.0.0, port=0

        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

        input_ifc=outside, output_ifc=any

Result:

input-interface: outside

input-status: up

input-line-status: up

output-interface: inside

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule

Thank you once again!

Jerry

Super Bronze

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Hi,

The "packet-tracer" still seems strange.

I dont know what is blocking it. There are no interface ACLs configured and the ASA should be currently using a setting that allows the traffic to flow freely from the AnyConnect Clients.

Just to to check that I am not blind looking at the above configurations (even with the find function) can you provide the output of these commands

show run all sysopt

show access-list

I think you can also remove this NAT configuration

no nat (inside,outside) source static any any destination static  NETWORK_OBJ_192.168.60.0_26 NETWORK_OBJ_192.168.60.0_26 no-proxy-arp  route-lookup

- Jouni

New Member

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Jouni,

I had already removed that othe NAT and tested it (still the same issue).  I am having another issue that I opened under the Firewall section, the DMZ portion can't NAT properly to the internet.  I'm almost ready to start from scratch and set everything up again to see if there is something hidden that is causing these strange issues.  I used an ASA5505 in 2006 and had no problems setting it up.

Here are the items you requested. If you would like I can send you the current config as well. There are quite a few access lists for the captures that if needed we can remove.

Thakn you again.

Jerry

***************************************************

mxfw(config)# sho run all sysopt

no sysopt connection timewait

sysopt connection tcpmss 1380

sysopt connection tcpmss minimum 0

sysopt connection permit-vpn

sysopt connection reclassify-vpn

no sysopt connection preserve-vpn-flows

no sysopt radius ignore-secret

no sysopt noproxyarp inside

no sysopt noproxyarp outside

no sysopt noproxyarp dmz

no sysopt noproxyarp dmz2

mxfw(config)# sho access-list

access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096)

            alert-interval 300

access-list capdmz; 2 elements; name hash: 0x38c007e1

access-list capdmz line 1 extended permit icmp host 172.26.20.22 host 208.67.222.222 (hitcnt=0) 0xd6afbe95

access-list capdmz line 2 extended permit icmp host 208.67.222.222 host 172.26.20.22 (hitcnt=0) 0xd46e851d

access-list capout; 2 elements; name hash: 0x3debe2e8

access-list capout line 1 extended permit icmp host 192.168.1.231 host 208.67.222.222 (hitcnt=0) 0xe5f7c7bb

access-list capout line 2 extended permit icmp host 208.67.222.222 host 192.168.1.231 (hitcnt=0) 0xfbf6f627

access-list capvpn; 2 elements; name hash: 0xcacb6b0b

access-list capvpn line 1 extended permit icmp host 192.168.60.20 host 10.1.10.23 (hitcnt=0) 0x9f25817e

access-list capvpn line 2 extended permit icmp host 10.1.10.23 host 192.168.60.20 (hitcnt=0) 0x1033d597

access-list AnyConnect_Client_Local_Print; 8 elements; name hash: 0xe76ce9d1

access-list AnyConnect_Client_Local_Print line 1 extended deny ip any any (hitcnt=0) 0x08993d53

access-list AnyConnect_Client_Local_Print line 2 extended permit tcp any any eq lpd (hitcnt=0) 0xc2390719

access-list AnyConnect_Client_Local_Print line 3 remark IPP: Internet Printing Protocol

access-list AnyConnect_Client_Local_Print line 4 extended permit tcp any any eq 631 (hitcnt=0) 0x73a9536a

access-list AnyConnect_Client_Local_Print line 5 remark Windows' printing port

access-list AnyConnect_Client_Local_Print line 6 extended permit tcp any any eq 9100 (hitcnt=0) 0x57c0d3e3

access-list AnyConnect_Client_Local_Print line 7 remark mDNS: multicast DNS protocol

access-list AnyConnect_Client_Local_Print line 8 extended permit udp any host 224.0.0.251 eq 5353 (hitcnt=0) 0x97c694f8

access-list AnyConnect_Client_Local_Print line 9 remark LLMNR: Link Local Multicast Name Resolution protocol

access-list AnyConnect_Client_Local_Print line 10 extended permit udp any host 224.0.0.252 eq 5355 (hitcnt=0) 0xa7d3d944

access-list AnyConnect_Client_Local_Print line 11 remark TCP/NetBIOS protocol

access-list AnyConnect_Client_Local_Print line 12 extended permit tcp any any eq 137 (hitcnt=0) 0x5f84372c

access-list AnyConnect_Client_Local_Print line 13 extended permit udp any any eq netbios-ns (hitcnt=0) 0xb541e0fb

access-list SPLIT-TUNNEL; 2 elements; name hash: 0x25b1daf1

access-list SPLIT-TUNNEL line 1 standard permit 10.0.1.0 255.255.255.0 (hitcnt=0) 0xbc2c6351

access-list SPLIT-TUNNEL line 2 standard permit 10.1.0.0 255.255.0.0 (hitcnt=0) 0x4b8231d9

access-list capins; 2 elements; name hash: 0xd373c10f

access-list capins line 1 extended permit icmp host 10.1.10.23 host 10.0.1.1 (hitcnt=0) 0x5e48d6b2

access-list capins line 2 extended permit icmp host 10.0.1.1 host 10.1.10.23 (hitcnt=0) 0xdbdfb942

Super Bronze

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Hi,

I am not sure if you have done it/mentioned it before, but if you havent, is there a chance you could save the firewall settings and reboot the firewall?

I just dont know why the firewall would block this traffic. It doesnt make sense. (Atleast at the moment)

You could naturally share the current configurations (even the local switch)

I am soon at a point where I wouldnt mind troubleshooting this from the actual ASA. I want to know what is causing this

- Jouni

New Member

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Hi,

Yes, I have saved the config and did a write erase and reloaded the config, no difference. I rebuilt it once a couple of weeks ago, but that was before I had gotten this far with your assistance.  I'll include my ASA and switches configs after this. Here is a little background (took it form the Firewall section issue just because it gives a little insight for the network). I have 2 3560s, one as a L3 switch the other L2 with an etherchannel between them (one of the cables was bad so I am waiting on the replacement to have 2 - Gigabit channels between the switches).

I think our issue with the VPN not getting to the Inside is posibly related to my DMZ issue not getting to the internet.

I am using 2 VLANs on my switch for Guests - one is wired and the other is wireless. I am trying to keep them separate because the wireless are any guest that might be at our restaurant that is getting on WiFi. The wired is for our Private Dining Rooms that vendors may need access and I don't want the wireless being able to see the wired network in that situation.

I have ports on my 3560s that are assigned to VLAN 20 (Guest Wired) and VLAN 22 (Guest Wireless). I am not routing those addresses within the 3560s (one 3560 is setup as a L3 switch). Those VLANs are being L2 switched to the ASA via the trunk to save ports (I tried separating them and used 2 ports on the ASA and it still didn't work). The ASA is providing DCHP for those VLANs and the routing for the DMZ VLANs. I can ping each of the gateways (which are the VLANs on the ASA from devices on the 3560s - 172.26.20.1 and 172.26.22.1. I have those in my DMZ off the ASA so it can control and route the data.

The 3560 is routing for my Corp VLANs. So far I have tested the Wired VLAN 10 (10.1.10.0/24) and it is working and gets to the Internet.  I have a default route (0.0.0.0 0.0.0.0) from the L3 switch to e0/1 on the ASA and e0/1 is an Inside interface.

E0/0 on the ASA is my Outside interface and gets it IP from the upstream router (will be an AT&T router/modem when I move it to the building).

So for a simple diagram:

PC (172.26.20.21/24) -----3560 (L2) ------Trunk----(VLAN 20 - DMZ/ VLAN 22 - DMZ2)---- ASA -----Outside ------- Internet (via router/modem)

I will be back at this tomorrow morning - I've been up since 4pm yesterday and it is almost 3pm.

Thank you for all of your assistance.

Jerry

********************************************************

Current ASA Config:

ASA Version 8.4(4)

!

hostname mxfw

domain-name moxiefl.com

enable password $$$$$$$$$$$$$$$ encrypted

passwd $$$$$$$$$$$$$$$$ encrypted

names

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

shutdown

!

interface Ethernet0/4

switchport access vlan 20

!

interface Ethernet0/5

switchport trunk allowed vlan 20,22

switchport mode trunk

!

interface Ethernet0/6

shutdown

!

interface Ethernet0/7

shutdown

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

!

interface Vlan20

nameif dmz

security-level 50

ip address 172.26.20.1 255.255.255.0

!

interface Vlan22

nameif dmz2

security-level 50

ip address 172.26.22.1 255.255.255.0

!

ftp mode passive

dns domain-lookup inside

dns domain-lookup outside

dns server-group DefaultDNS

name-server 208.67.222.222

name-server 208.67.220.220

domain-name moxiefl.com

same-security-traffic permit inter-interface

object network Generic_All_Network

subnet 0.0.0.0 0.0.0.0

object network INSIDE_Hosts

subnet 10.1.0.0 255.255.0.0

object network AnyConnect_Hosts

subnet 192.168.60.0 255.255.255.0

object network NETWORK_OBJ_192.168.60.0_26

subnet 192.168.60.0 255.255.255.192

object network DMZ_Network

subnet 172.26.20.0 255.255.255.0

object network DMZ2_Network

subnet 172.26.22.0 255.255.255.0

object network INSIDE

subnet 10.0.1.0 255.255.255.0

access-list capdmz extended permit icmp host 172.26.20.22 host 208.67.222.222

access-list capdmz extended permit icmp host 208.67.222.222 host 172.26.20.22

access-list capout extended permit icmp host 192.168.1.231 host 208.67.222.222

access-list capout extended permit icmp host 208.67.222.222 host 192.168.1.231

access-list capvpn extended permit icmp host 192.168.60.20 host 10.1.10.23

access-list capvpn extended permit icmp host 10.1.10.23 host 192.168.60.20

access-list AnyConnect_Client_Local_Print extended deny ip any any

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd

access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631

access-list AnyConnect_Client_Local_Print remark Windows' printing port

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100

access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol

access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353

access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol

access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355

access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137

access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns

access-list SPLIT-TUNNEL standard permit 10.0.1.0 255.255.255.0

access-list SPLIT-TUNNEL standard permit 10.1.0.0 255.255.0.0

access-list capins extended permit icmp host 10.1.10.23 host 10.0.1.1

access-list capins extended permit icmp host 10.0.1.1 host 10.1.10.23

pager lines 24

mtu inside 1500

mtu outside 1500

mtu dmz 1500

mtu dmz2 1500

ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (inside,outside) source static INSIDE INSIDE destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

nat (dmz,outside) source dynamic Generic_All_Network interface

nat (dmz2,outside) source dynamic Generic_All_Network interface

!

nat (inside,outside) after-auto source dynamic Generic_All_Network interface

route inside 10.1.0.0 255.255.0.0 10.0.1.2 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

http server enable

http 10.0.0.0 255.0.0.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec ikev2 ipsec-proposal AES256

protocol esp encryption aes-256

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES192

protocol esp encryption aes-192

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES

protocol esp encryption aes

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal 3DES

protocol esp encryption 3des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal DES

protocol esp encryption des

protocol esp integrity sha-1 md5

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto ca trustpoint ASDM_TrustPoint0

enrollment self

fqdn anyconnect.moxiefl.com

subject-name CN=AnyConnect.moxiefl.com

keypair AnyConnect

proxy-ldc-issuer

crl configure

crypto ca certificate chain ASDM_TrustPoint0

certificate 439a4452

    3082026c 308201d5 a0030201 02020443 9a445230 0d06092a 864886f7 0d010105

    05003048 311f301d 06035504 03131641 6e79436f 6e6e6563 742e6d6f 78696566

    6c2e636f 6d312530 2306092a 864886f7 0d010902 1616616e 79636f6e 6e656374

    2e6d6f78 6965666c 2e636f6d 301e170d 31333039 32373037 32353331 5a170d32

    33303932 35303732 3533315a 3048311f 301d0603 55040313 16416e79 436f6e6e

    6563742e 6d6f7869 65666c2e 636f6d31 25302306 092a8648 86f70d01 09021616

    616e7963 6f6e6e65 63742e6d 6f786965 666c2e63 6f6d3081 9f300d06 092a8648

    86f70d01 01010500 03818d00 30818902 8181009a d9f320ff e93d4fdd cb707a4c

    b4664c47 6d2cc639 4dc45fed bfbc2150 7109fd81 5d6a5252 3d40dc43 696360d5

    fbf92bcc 477d19b8 5301085c daf40de5 87d7e4aa f81b8d7f 8d364dfa 0a6f07d7

    6a7c3e9b 56e69152 aa5492d8 e35537bd 567ccf29 7afbeae8 13da9936 9f890d76

    1d56d11d da3d039a 0e714849 e6841ff2 5483b102 03010001 a3633061 300f0603

    551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06

    03551d23 04183016 80142f27 7096c4c5 e396e691 e07ef737 af61b71f 64f1301d

    0603551d 0e041604 142f2770 96c4c5e3 96e691e0 7ef737af 61b71f64 f1300d06

    092a8648 86f70d01 01050500 03818100 8f777196 bbe6a5e4 8af9eb9a 514a8348

    5e62d6cd 47257243 e430a758 2b367543 065d4ceb 582bf666 08ff7be1 f89287a2

    ac527824 b11c2048 7fd2b50d 35ca3902 6aa00675 e4df7859 f3590596 b1d52426

    1e97a52c 4e77f4b0 226dec09 713f7ba9 80bdf7bb b52a7da2 4a68b91b 455cabba

    0cc4c6f3 f244f7d9 0a6e32fb 31ce7e35

  quit

crypto ikev2 policy 1

encryption aes-256

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 10

encryption aes-192

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 20

encryption aes

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 30

encryption 3des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 40

encryption des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 enable outside client-services port 443

crypto ikev2 remote-access trustpoint ASDM_TrustPoint0

telnet timeout 5

ssh 10.0.0.0 255.0.0.0 inside

ssh timeout 5

ssh key-exchange group dh-group1-sha1

console timeout 0

dhcpd dns 208.67.222.222 208.67.220.220

dhcpd auto_config outside

!

dhcpd address 10.0.1.20-10.0.1.40 inside

dhcpd dns 208.67.222.222 208.67.220.220 interface inside

dhcpd enable inside

!

dhcpd address 172.26.20.21-172.26.20.60 dmz

dhcpd dns 208.67.222.222 208.67.220.220 interface dmz

dhcpd enable dmz

!

dhcpd address 172.26.22.21-172.26.22.200 dmz2

dhcpd dns 208.67.222.222 208.67.220.220 interface dmz2

dhcpd enable dmz2

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ssl trust-point ASDM_TrustPoint0 outside

webvpn

enable outside

anyconnect-essentials

anyconnect image disk0:/anyconnect-win-3.0.2052-k9.pkg 1

anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml

anyconnect enable

tunnel-group-list enable

group-policy GroupPolicy_AnyConnect internal

group-policy GroupPolicy_AnyConnect attributes

wins-server none

dns-server value 208.67.222.222 208.67.220.220

vpn-tunnel-protocol ikev2 ssl-client

split-tunnel-policy tunnelspecified

split-tunnel-network-list value SPLIT-TUNNEL

default-domain value moxiefl.com

webvpn

  anyconnect profiles value AnyConnect_client_profile type user

username user1 password $$$$$$$$$$$$$ encrypted privilege 15

username user2 password $$$$$$$$$$$ encrypted privilege 15

tunnel-group AnyConnect type remote-access

tunnel-group AnyConnect general-attributes

address-pool VPN_POOL

default-group-policy GroupPolicy_AnyConnect

tunnel-group AnyConnect webvpn-attributes

group-alias AnyConnect enable

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip

  inspect xdmcp

  inspect icmp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:f6d9bbacca2a5c8b5af946a8ddc12550

: end

****************************************************************************

L3 3560 connects to ASA via port f0/3 routed port 10.0.1.0/24 network

Connects to second 3560 via G0/3 & G0/4

version 12.2

no service pad

no service timestamps debug uptime

no service timestamps log uptime

service password-encryption

!

hostname mx3560a

!

boot-start-marker

boot-end-marker

!

enable secret 5 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

!

!

!

no aaa new-model

system mtu routing 1500

authentication mac-move permit

ip subnet-zero

ip routing

ip dhcp excluded-address 10.1.10.1 10.1.10.20

ip dhcp excluded-address 10.1.12.1 10.1.12.20

ip dhcp excluded-address 10.1.14.1 10.1.14.20

ip dhcp excluded-address 10.1.16.1 10.1.16.20

ip dhcp excluded-address 10.1.30.1 10.1.30.20

ip dhcp excluded-address 10.1.35.1 10.1.35.20

ip dhcp excluded-address 10.1.50.1 10.1.50.20

ip dhcp excluded-address 10.1.80.1 10.1.80.20

ip dhcp excluded-address 10.1.90.1 10.1.90.20

ip dhcp excluded-address 10.1.100.1 10.1.100.20

ip dhcp excluded-address 10.1.101.1 10.1.101.20

!

ip dhcp pool VLAN10

   network 10.1.10.0 255.255.255.0

   default-router 10.1.10.1

   dns-server 208.67.222.222 208.67.220.220

!

ip dhcp pool VLAN12

   network 10.1.12.0 255.255.255.0

   default-router 10.1.12.1

   dns-server 208.67.222.222 208.67.220.220

!

ip dhcp pool VLAN14

   network 10.1.14.0 255.255.255.0

   default-router 10.1.14.1

   option 150 ip 10.1.13.1

!

ip dhcp pool VLAN16

   network 10.1.16.0 255.255.255.0

   default-router 10.1.16.1

   dns-server 208.67.222.222 208.67.220.220

!

ip dhcp pool VLAN30

   network 10.1.30.0 255.255.255.0

   default-router 10.1.30.1

   dns-server 208.67.222.222 208.67.220.220

!

ip dhcp pool VLAN35

   network 10.1.35.0 255.255.255.0

   default-router 10.1.35.1

   dns-server 208.67.222.222 208.67.220.220

!

ip dhcp pool VLAN50

   network 10.1.50.0 255.255.255.0

   default-router 10.1.50.1

   option 43 hex f104.0a01.6564

!

ip dhcp pool VLAN80

   network 10.1.80.0 255.255.255.0

   default-router 10.1.80.1

   dns-server 208.67.222.222 208.67.220.220

!

ip dhcp pool VLAN90

   network 10.1.90.0 255.255.255.0

   default-router 10.1.90.1

   dns-server 208.67.222.222 208.67.220.220

!

ip dhcp pool VLAN100

   network 10.1.100.0 255.255.255.0

   default-router 10.1.100.1

!

ip dhcp pool VLAN101

   network 10.1.101.0 255.255.255.0

   default-router 10.1.101.1

!

ip dhcp pool VLAN40

   dns-server 208.67.222.222 208.67.220.220

!

!

!

!

!

!

port-channel load-balance src-dst-mac

spanning-tree mode pvst

spanning-tree etherchannel guard misconfig

spanning-tree extend system-id

!

vlan internal allocation policy ascending

!

!

!

!

interface Port-channel1

switchport trunk encapsulation dot1q

switchport mode trunk

link state group 1 downstream

!

interface FastEthernet0/1

switchport trunk encapsulation dot1q

switchport trunk native vlan 100

switchport mode trunk

power inline never

!

interface FastEthernet0/2

switchport access vlan 10

switchport mode access

power inline never

!

interface FastEthernet0/3

description Interface to MXFW E0/1

no switchport

ip address 10.0.1.2 255.255.255.0

power inline never

!

interface FastEthernet0/4

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/5

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/6

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/7

switchport trunk encapsulation dot1q

switchport trunk native vlan 30

switchport mode trunk

switchport voice vlan 14

power inline never

spanning-tree portfast

!

interface FastEthernet0/8

switchport access vlan 30

switchport mode access

power inline never

!

interface FastEthernet0/9

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/10

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/11

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/12

switchport access vlan 40

switchport mode access

!

interface FastEthernet0/13

switchport access vlan 40

switchport mode access

!

interface FastEthernet0/14

switchport access vlan 40

switchport mode access

!

interface FastEthernet0/15

switchport access vlan 40

switchport mode access

shutdown

!

interface FastEthernet0/16

switchport access vlan 40

switchport mode access

shutdown

!

interface FastEthernet0/17

switchport access vlan 50

switchport mode access

!

interface FastEthernet0/18

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/19

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/20

switchport trunk encapsulation dot1q

switchport trunk native vlan 10

switchport mode trunk

switchport voice vlan 14

spanning-tree portfast

!

interface FastEthernet0/21

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/22

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/23

switchport trunk encapsulation dot1q

switchport trunk native vlan 30

switchport mode trunk

switchport voice vlan 14

spanning-tree portfast

!

interface FastEthernet0/24

switchport access vlan 35

switchport mode access

power inline never

!

interface FastEthernet0/25

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/26

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/27

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/28

switchport access vlan 40

switchport mode access

!

interface FastEthernet0/29

switchport access vlan 40

switchport mode access

!

interface FastEthernet0/30

switchport access vlan 40

switchport mode access

!

interface FastEthernet0/31

switchport access vlan 40

switchport mode access

shutdown

!

interface FastEthernet0/32

switchport access vlan 40

switchport mode access

shutdown

!

interface FastEthernet0/33

switchport access vlan 50

switchport mode access

!

interface FastEthernet0/34

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/35

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/36

switchport trunk encapsulation dot1q

switchport trunk native vlan 10

switchport mode trunk

switchport voice vlan 14

spanning-tree portfast

!

interface FastEthernet0/37

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/38

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/39

switchport access vlan 30

switchport mode access

power inline never

!

interface FastEthernet0/40

switchport access vlan 90

switchport mode access

power inline never

!

interface FastEthernet0/41

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/42

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/43

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/44

switchport access vlan 40

switchport mode access

!

interface FastEthernet0/45

switchport access vlan 40

switchport mode access

!

interface FastEthernet0/46

switchport access vlan 40

switchport mode access

shutdown

!

interface FastEthernet0/47

switchport access vlan 40

switchport mode access

shutdown

!

interface FastEthernet0/48

switchport mode access

shutdown

power inline never

!

interface GigabitEthernet0/1

description Interface to MXC2911 Port G0/0

no switchport

ip address 10.1.13.2 255.255.255.0

!

interface GigabitEthernet0/2

shutdown

!

interface GigabitEthernet0/3

switchport trunk encapsulation dot1q

switchport mode trunk

channel-group 1 mode on

!

interface GigabitEthernet0/4

switchport trunk encapsulation dot1q

switchport mode trunk

channel-group 1 mode on

!

interface Vlan1

no ip address

shutdown

!

interface Vlan10

ip address 10.1.10.1 255.255.255.0

!

interface Vlan12

ip address 10.1.12.1 255.255.255.0

!

interface Vlan14

ip address 10.1.14.1 255.255.255.0

!

interface Vlan16

ip address 10.1.16.1 255.255.255.0

!

interface Vlan20

ip address 172.26.20.1 255.255.255.0

!

interface Vlan22

ip address 172.26.22.1 255.255.255.0

!

interface Vlan30

ip address 10.1.30.1 255.255.255.0

!

interface Vlan35

ip address 10.1.35.1 255.255.255.0

!

interface Vlan40

ip address 10.1.40.1 255.255.255.0

!

interface Vlan50

ip address 10.1.50.1 255.255.255.0

!

interface Vlan80

ip address 172.16.80.1 255.255.255.0

!

interface Vlan86

no ip address

shutdown

!

interface Vlan90

ip address 10.1.90.1 255.255.255.0

!

interface Vlan100

ip address 10.1.100.1 255.255.255.0

!

interface Vlan101

ip address 10.1.101.1 255.255.255.0

!

!

router eigrp 1

network 10.0.0.0

network 10.1.13.0 0.0.0.255

network 10.1.14.0 0.0.0.255

passive-interface default

no passive-interface GigabitEthernet0/1

!

ip classless

ip route 0.0.0.0 0.0.0.0 FastEthernet0/3 10.0.1.1

ip route 192.168.60.0 255.255.255.0 FastEthernet0/3 10.0.1.1 2

ip http server

!

!

ip sla enable reaction-alerts

!

!

!

line con 0

logging synchronous

line vty 0 4

login

line vty 5 15

login

!

end

******************************************************************

L3 3560 Route Table (I added 192.168.60.0/24 instead of just using the default route just in case it wasn't routing for some reason - no change)

mx3560a#sho ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.0.1.1 to network 0.0.0.0

S    192.168.60.0/24 [2/0] via 10.0.1.1, FastEthernet0/3

     172.16.0.0/24 is subnetted, 1 subnets

C       172.16.80.0 is directly connected, Vlan80

     172.26.0.0/24 is subnetted, 2 subnets

C       172.26.22.0 is directly connected, Vlan22

C       172.26.20.0 is directly connected, Vlan20

     10.0.0.0/8 is variably subnetted, 14 subnets, 2 masks

C       10.1.10.0/24 is directly connected, Vlan10

D       10.1.13.5/32 [90/3072] via 10.1.13.1, 4d02h, GigabitEthernet0/1

C       10.1.14.0/24 is directly connected, Vlan14

C       10.1.13.0/24 is directly connected, GigabitEthernet0/1

C       10.1.12.0/24 is directly connected, Vlan12

C       10.0.1.0/24 is directly connected, FastEthernet0/3

C       10.1.30.0/24 is directly connected, Vlan30

C       10.1.16.0/24 is directly connected, Vlan16

C       10.1.40.0/24 is directly connected, Vlan40

C       10.1.35.0/24 is directly connected, Vlan35

C       10.1.50.0/24 is directly connected, Vlan50

C       10.1.90.0/24 is directly connected, Vlan90

C       10.1.101.0/24 is directly connected, Vlan101

C       10.1.100.0/24 is directly connected, Vlan100

S*   0.0.0.0/0 [1/0] via 10.0.1.1, FastEthernet0/3

I have a C2911 for CME on G0/1 - using it only for that purpose at this time.

*******************************************************************

L2 3560 Config it connects to the ASA as a trunk on e0/5 of the ASA and port f0/3 of the switch - I am using L2 switching for the DMZ networks from the switches to the ASA and allowing the ASA to provide the DHCP and routing out of the network. DMZ networks: 172.26.20.0/24 and 172.26.22.0/24.

version 12.2

no service pad

no service timestamps debug uptime

no service timestamps log uptime

service password-encryption

!

hostname mx3560b

!

boot-start-marker

boot-end-marker

!

enable secret 5 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

!

!

!

no aaa new-model

system mtu routing 1500

!

!

!

!

crypto pki trustpoint TP-self-signed-3877365632

enrollment selfsigned

subject-name cn=IOS-Self-Signed-Certificate-3877365632

revocation-check none

rsakeypair TP-self-signed-3877365632

!

!

crypto pki certificate chain TP-self-signed-3877365632

certificate self-signed 01

  30820240 308201A9 A0030201 02020101 300D0609 2A864886 F70D0101 04050030

  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274

  69666963 6174652D 33383737 33363536 3332301E 170D3933 30333031 30303031

  30395A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649

  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 38373733

  36353633 3230819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281

  8100DF81 DA515E0B 7FC760CF 2CC98400 42DCA007 215E4DDE D0C3FBF2 D974CE85

  C46A8700 6AE44C2C 79D9BD2A A9297FA0 2D9C2BE4 B3941A2F 435AC4EA 17E89DFE

  34EC8E93 63BD4CDF 784E91D7 2EE0093F 06CC97FD 83CB818B 1ED624E6 F0F5DA51

  1DE4B8A7 169EED2B 40575B81 BADDE052 85BA9D19 4C206DCB 00878FF3 89E74028

  B3F30203 010001A3 68306630 0F060355 1D130101 FF040530 030101FF 30130603

  551D1104 0C300A82 086D7833 35363062 2E301F06 03551D23 04183016 80147125

  78CE8540 DB95D852 3C0BD975 5D9C6EB7 58FC301D 0603551D 0E041604 14712578

  CE8540DB 95D8523C 0BD9755D 9C6EB758 FC300D06 092A8648 86F70D01 01040500

  03818100 94B98410 2D9CD602 4BD16181 BCB7C515 77C8F947 7C4AF5B8 281E3131

  59298655 B12FAB1D A6AAA958 8473483C E993D896 5251770B 557803C0 531DEB62

  A349C057 CB473F86 DCEBF8B8 7DDE5728 048A49D0 AB18CE8C 8257C00A C2E06A63

  B91F872C 5F169FF9 77DC523B AB1E3965 C6B67FCC 84AE11E9 02DD10F0 C45EAFEA 41D7FA6C

  quit

!

!

!

port-channel load-balance src-dst-mac

spanning-tree mode pvst

spanning-tree extend system-id

!

vlan internal allocation policy ascending

!

!

!

!

interface Port-channel1

switchport trunk encapsulation dot1q

switchport mode trunk

!

interface FastEthernet0/1

switchport access vlan 50

switchport mode access

!

interface FastEthernet0/2

switchport access vlan 30

switchport mode access

power inline never

!

interface FastEthernet0/3

switchport trunk encapsulation dot1q

switchport trunk allowed vlan 20,22

switchport mode trunk

power inline never

!

interface FastEthernet0/4

switchport mode access

shutdown

power inline never

!

interface FastEthernet0/5

shutdown

power inline never

!

interface FastEthernet0/6

shutdown

power inline never

!

interface FastEthernet0/7

switchport trunk encapsulation dot1q

switchport trunk native vlan 30

switchport mode trunk

switchport voice vlan 14

spanning-tree portfast

!

interface FastEthernet0/8

switchport access vlan 30

switchport mode access

power inline never

!

interface FastEthernet0/9

shutdown

power inline never

!

interface FastEthernet0/10

switchport access vlan 20

switchport mode access

power inline never

!

interface FastEthernet0/11

shutdown

power inline never

!

interface FastEthernet0/12

switchport access vlan 40

switchport mode access

!

interface FastEthernet0/13

switchport access vlan 40

switchport mode access

!

interface FastEthernet0/14

switchport access vlan 40

switchport mode access

shutdown

!

interface FastEthernet0/15

switchport access vlan 40

switchport mode access

shutdown

!

interface FastEthernet0/16

switchport access vlan 40

switchport mode access

shutdown

!

interface FastEthernet0/17

switchport access vlan 10

switchport mode access

power inline never

!

interface FastEthernet0/18

shutdown

power inline never

!

interface FastEthernet0/19

shutdown

power inline never

!

interface FastEthernet0/20

switchport trunk encapsulation dot1q

switchport trunk native vlan 10

switchport mode trunk

switchport voice vlan 14

spanning-tree portfast

!

interface FastEthernet0/21

shutdown

power inline never

!

interface FastEthernet0/22

shutdown

power inline never

!

interface FastEthernet0/23

switchport access vlan 30

switchport mode access

power inline never

!

interface FastEthernet0/24

shutdown

power inline never

!

interface FastEthernet0/25

switchport access vlan 20

switchport mode access

power inline never

!

interface FastEthernet0/26

shutdown

power inline never

!

interface FastEthernet0/27

shutdown

power inline never

!

interface FastEthernet0/28

switchport access vlan 40

switchport mode access

!

interface FastEthernet0/29

switchport access vlan 40

switchport mode access

!

interface FastEthernet0/30

switchport access vlan 40

switchport mode access

shutdown

!

interface FastEthernet0/31

switchport access vlan 40

switchport mode access

shutdown

!

interface FastEthernet0/32

switchport access vlan 40

switchport mode access

shutdown

!

interface FastEthernet0/33

switchport access vlan 20

switchport mode access

power inline never

!

interface FastEthernet0/34

shutdown

power inline never

!

interface FastEthernet0/35

shutdown

power inline never

!

interface FastEthernet0/36

switchport mode access

switchport voice vlan 14

spanning-tree portfast

!

interface FastEthernet0/37

shutdown

power inline never

!

interface FastEthernet0/38

shutdown

power inline never

!

interface FastEthernet0/39

switchport access vlan 30

switchport mode access

power inline never

!

interface FastEthernet0/40

switchport access vlan 90

switchport mode access

power inline never

!

interface FastEthernet0/41

shutdown

power inline never

!

interface FastEthernet0/42

shutdown

power inline never

!

interface FastEthernet0/43

shutdown

power inline never

!

interface FastEthernet0/44

switchport access vlan 40

switchport mode access

!

interface FastEthernet0/45

switchport access vlan 40

switchport mode access

!

interface FastEthernet0/46

switchport access vlan 40

switchport mode access

shutdown

!

interface FastEthernet0/47

switchport access vlan 40

switchport mode access

shutdown

!

interface FastEthernet0/48

switchport access vlan 40

switchport mode access

shutdown

!

interface GigabitEthernet0/1

shutdown

!

interface GigabitEthernet0/2

switchport access vlan 40

switchport mode access

!

interface GigabitEthernet0/3

switchport trunk encapsulation dot1q

switchport mode trunk

channel-group 1 mode on

!

interface GigabitEthernet0/4

switchport trunk encapsulation dot1q

switchport mode trunk

channel-group 1 mode on

!

interface Vlan1

no ip address

!

ip classless

ip http server

ip http secure-server

!

!

ip sla enable reaction-alerts

!

!

!

line con 0

logging synchronous

line vty 0 4

login

line vty 5 15

login

!

end

Super Bronze

Re: AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside

Hi,

I am still not sure about the VPN portion.

What I was wondering is why do you have the same IP address for Vlan20 and Vlan22 configured in the Switch Vlan interface and the ASA Vlan interface.

You should probably remove the interface Vlan22 and Vlan20 from the switch completely since its not required for any purpose, not GW nor switch management IP.

- Jouni

New Member

Re: AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside

Jouni,

Thank you for the catch, I thought I had removed them from the switch when I moved everything for the DMZ to the ASA. That's the problem with long hours and not getting to work on this without interruptions.

I'll make those changes tomorrow when I get back on-site.

A second set of eyes always helps. I might rebuild the ASA tomorrow from scratch depending on what you find.

Jerry

Super Bronze

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Hi,

I am not clear on what is blocking the traffic in your "packet-tracer"

In the previous one we can see that the traffic from the connected VPN Client user is matching the correct NAT configurations and the correct output interface is chosen. When the ASA has performed UN-NAT for the destination IP address it then goes on to check the ACL.

Here is where it gets strange,

There is a default setting called "sysopt connection permit-vpn" which doesnt show up in the CLI but does show up with the command I mentioned (which you provided before) that was "show run all sysopt"

This setting should allow all traffic from a VPN user to bypass any interface ACL you might have on the "outside" interface. Yet your traffic is getting blocked.

Since I am not sure what is causing this I would suggest testing the following

no sysopt connection permit-vpn

access-list OUTSIDE-IN remark Allow VPN Client traffic

access-list OUTSIDE-IN permit ip 192.168.60.0 255.255.255.0 10.1.0.0 255.255.0.0

access-list OUTSIDE-IN permit ip 192.168.60.0 255.255.255.0 10.0.1.0 255.255.255.0

access-group OUTSIDE-IN in interface outside

And then try to connect again with the VPN Client and take the "packet-tracer" output again and see if there is no change. If there is no change you could probably change back to the setting "sysopt connection permit-vpn"

After this I would probably consider getting some other software for the ASA because it seems to me that were pretty much exhausted the most typical reasons for this problem. Naturally I cant be 100% sure that I have checked everything that might be related to this.

At one point 8.4(5) was suggested to us to be one of the stablest/problem free software (I guess it depends on your setup really). You could try it if you can get your hands on the software. There is also versions 8.4(6) BUT there has been a couple of threads here on the forums where a user has encountered problems when using DHCP on the external interface. There should also be 8.4(7), then there is naturally the 9.x series software levels

With regards to the DMZ Vlan interface IP addresses I would see that as a clear problem related to the DMZ connectivity. They are using the .1 IP addresses as default gateways and if they ARP for the MAC address of that IP both the ASA and Switch could answer that ARP request.

- Jouni

New Member

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Jouni,

Well the packet-tracer worked see below.

But still Request timed out on my ping attempts from the AnyConnect computer.

So I did something I should have done earlier.  I installed Wireshark on the PC I am trying to ping.

The pings are arriving on that PC. I know there is an issue with Wireshark not always seeing the outbound traffic of the interface it is monitoring, so the PC is probably sending the replies back, I just can't see them because of where I'm monitoring.

So, I then removed the access-group and turned sysopt connection permit-vpn
back on.  I then VPN'd back into the network and did the ping again and it is getting to the PC (just still timing out).

The packet-tracer however goes back to failing as before - so that is probably a glitch in the packet-tracer.

The DMZ issue was resolved once I removed those IP addresses I missed and flushed the ARP table on the PC I was using to test with.  Thanks again for catching that.

Based on the results below using Wireshark on both PCs, it appears the PCs are not Replying for teh failed Ping attempts. It appears everything is routing, but for some reason both PCs are not replying to some of the Echo Requests.

Network Ping Results Table:

Passes:

10.1.10.1 (VLAN 10 3560a) <-> 10.0.1.1 (ASA)

10.1.10.1 <-> 10.1.10.24 (PC - Wireshark shows Echo Request arriving and Echo Reply going back)

10.1.10.24 -> 10.0.1.1

192.168.60.20 -> 10.0.1.1

192.168.60.20 -> 10.1.10.1

Fails:

10.0.1.1 ->10.1.10.24 (Fails - but Wireshark shows Echo Request arriving at PC - no Echo Reply)

10.0.1.1 (192.168.1.231) -> 192.168.60.20 (Wireshark shows Echo Request arriving but no Echo Reply)

10.1.10.1 (10.0.1.2) -> 192.168.60.20 (Wireshark shows Echo Request arriving but no Echo Reply)

10.1.10.24 <-> 192.168.60.20 (Wireshark on each computer shows the Echo Request arriving but no Echo Reply)

**************************************************************

mxfw# packet-tracer input outside icmp 192.168.60.20 8 0 10.1.10.23 detailed

Phase: 1

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in  id=0xac74d238, priority=1, domain=permit, deny=false

        hits=446453, user_data=0x0, cs_id=0x0, l3_type=0x8

        src mac=0000.0000.0000, mask=0000.0000.0000

        dst mac=0000.0000.0000, mask=0100.0000.0000

        input_ifc=outside, output_ifc=any

Phase: 2

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in   10.1.0.0        255.255.0.0     inside

Phase: 3

Type: UN-NAT

Subtype: static

Result: ALLOW

Config:

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

Additional Information:

NAT divert to egress interface inside

Untranslate 10.1.10.23/0 to 10.1.10.23/0

Phase: 4

Type: ACCESS-LIST

Subtype: log

Result: ALLOW

Config:

access-group OUTSIDE-IN in interface outside

access-list OUTSIDE-IN extended permit ip 192.168.60.0 255.255.255.0 10.1.0.0 255.255.0.0

Additional Information:

Forward Flow based lookup yields rule:

in  id=0xad053058, priority=13, domain=permit, deny=false

        hits=16, user_data=0xa9a35f20, cs_id=0x0, use_real_addr, flags=0x0, protocol=0

        src ip/id=192.168.60.0, mask=255.255.255.0, port=0

        dst ip/id=10.1.0.0, mask=255.255.0.0, port=0, dscp=0x0

        input_ifc=outside, output_ifc=any

Phase: 5

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in  id=0xac751130, priority=0, domain=inspect-ip-options, deny=true

        hits=10116, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0

        src ip/id=0.0.0.0, mask=0.0.0.0, port=0

        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

        input_ifc=outside, output_ifc=any

Phase: 6

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class inspection_default

  inspect icmp

service-policy global_policy global

Additional Information:

Forward Flow based lookup yields rule:

in  id=0xad230568, priority=70, domain=inspect-icmp, deny=false

        hits=21, user_data=0xad2a9848, cs_id=0x0, use_real_addr, flags=0x0, protocol=1

        src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0

        dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0

        input_ifc=outside, output_ifc=any

Phase: 7

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in  id=0xac750d08, priority=66, domain=inspect-icmp-error, deny=false

        hits=36, user_data=0xac750320, cs_id=0x0, use_real_addr, flags=0x0, protocol=1

        src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0

        dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, dscp=0x0

        input_ifc=outside, output_ifc=any

Phase: 8

Type: VPN

Subtype: ipsec-tunnel-flow

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in  id=0xad053130, priority=13, domain=ipsec-tunnel-flow, deny=true

        hits=297, user_data=0x0, cs_id=0x0, flags=0x0, protocol=0

        src ip/id=0.0.0.0, mask=0.0.0.0, port=0

        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

        input_ifc=outside, output_ifc=any

Phase: 9

Type: NAT

Subtype: rpf-check

Result: ALLOW

Config:

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

Additional Information:

Forward Flow based lookup yields rule:

out id=0xac7f5a78, priority=6, domain=nat-reverse, deny=false

        hits=17, user_data=0xac7f5178, cs_id=0x0, use_real_addr, flags=0x0, protocol=0

        src ip/id=192.168.60.0, mask=255.255.255.0, port=0

        dst ip/id=10.1.0.0, mask=255.255.0.0, port=0, dscp=0x0

        input_ifc=outside, output_ifc=inside

Phase: 10

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Reverse Flow based lookup yields rule:

in  id=0xac7171b0, priority=0, domain=inspect-ip-options, deny=true

        hits=9036, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0

        src ip/id=0.0.0.0, mask=0.0.0.0, port=0

        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

        input_ifc=inside, output_ifc=any

Phase: 11

Type: FLOW-CREATION

Subtype:

Result: ALLOW

Config:

Additional Information:

New flow created with id 10173, packet dispatched to next module

Module information for forward flow ...

snp_fp_tracer_drop

snp_fp_inspect_ip_options

snp_fp_inspect_icmp

snp_fp_translate

snp_fp_adjacency

snp_fp_fragment

snp_ifc_stat

Module information for reverse flow ...

snp_fp_tracer_drop

snp_fp_inspect_ip_options

snp_fp_translate

snp_fp_inspect_icmp

snp_fp_adjacency

snp_fp_fragment

snp_ifc_stat

Result:

input-interface: outside

input-status: up

input-line-status: up

output-interface: inside

output-status: up

output-line-status: up

Action: allow

Super Bronze

Re: AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside

Hi,

I think the previous "packet-tracer" you had posted didnt go through with regards to the ICMP test from the VPN Client and that is why I suggested the strange configurations.

The idea was to have the interface ACL configured with the "access-group" command and also have the "no sysopt connection permit-vpn" BUT as long as the connection is passing the ASA then its fine.

Have you considered the possibility that the PCs just wont reply to ICMP Echo?

I have had some problems with Windows hosts getting to reply to ICMP Echo whatever I have done. While they can ICMP to other network devices with no problems.

Do you have firewall software enabled on the hosts? Seems that everything else is replying to ICMP other than the actual hosts (LAN -> VPN, VPN -> LAN) Do you perhaps have some device for the LAN that you can attach to the same LAN as the actual hosts as a Dummy device that you know will reply to ICMP Echo and test traffic to that host from the VPN Client?

I didnt participate in the Firewall section dicussion but you can naturally rate the DMZ related reply if you found it to be helpfull.

Would like to solve the problem related to the VPN also.

- Jouni

New Member

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Jouni,

Well pings might not be working from computer to computer, but I setup a VNC server on my Inside network computer and I am able to access via the VPN.

Thank you again for all of your assistance.

Jerry

Super Bronze

Re: AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside

Hi,

Glad to hear you have gotten the actual TCP connections working

Have a look at my above post. I think you might have been posting while I was writing that.

If everything is ok then please remember to mark a reply as the correct answer if it answered your question and/or rate helpfull answers

Though naturally if there is still some problems feel free to ask/post more

- Jouni

New Member

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Jouni,

Thank you for your assistance!

That worked, I'm not getting to the 10.0.1.0 subnet, but I can work around that.

Thank you again.

Jerry

Super Bronze

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Hi,

Great to hear that it works.

I think you should be able to get to the network directly connected to the ASA "inside" also.

Naturally you can try if a new "nat" configuration would help at all

object network INSIDE

subnet 10.0.1.0 255.255.255.0

nat (inside,outside) 1 source static INSIDE INSIDE destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

If it still doesnt work we could always check the NAT configurations again and also take "packet-tracer" command output to see if there is any problem on the ASA itself

For example when you are connected with VPN client you could issue the command

packet-tracer input outside icmp 8 0 10.0.1.100

This should show which rules/configuration are applied to this connection that is not working. Just insert the IP address that your VPN Client gets. The destination IP address in the above command is just an example. It doesnt really matter what it is as long as its part of the network/subnet to which we simulate/test traffic.

- Jouni

New Member

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Jouni,

Here is the packet tracer.  I added the NAT you suggested but it didn't work.  If possible I would like to get the Split Tunnel setup so the VPN computer can get to the internet (currently it isn't working and I tried to setup the Split Tunnel using the ASDM). I removed the Split Tunnel change and cleared the xlate and ran the packet tracer (the PING to the INSIDE network still didn't work - the INSIDE _Hosts is working.

Thank you again for all of your assistance.

Jerry

******************************

mxfw(config)# packet-tracer input outside icmp 192.168.60.20 8 0 10.0.1.100 de$

mxfw(config)# packet-tracer input outside icmp 192.168.60.20 8 0 10.0.1.100 de$

Phase: 1

Type: CAPTURE

Subtype:

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in  id=0xad054768, priority=13, domain=capture, deny=false

        hits=330478, user_data=0xad23fec0, cs_id=0x0, l3_type=0x0

        src mac=0000.0000.0000, mask=0000.0000.0000

        dst mac=0000.0000.0000, mask=0000.0000.0000

        input_ifc=outside, output_ifc=any

Phase: 2

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in  id=0xac751378, priority=1, domain=permit, deny=false

        hits=164957, user_data=0x0, cs_id=0x0, l3_type=0x8

        src mac=0000.0000.0000, mask=0000.0000.0000

        dst mac=0000.0000.0000, mask=0100.0000.0000

        input_ifc=outside, output_ifc=any

Phase: 3

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in   10.0.1.0        255.255.255.0   inside

Phase: 4

Type: UN-NAT

Subtype: static

Result: ALLOW

Config:

nat (inside,outside) source static INSIDE INSIDE destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

Additional Information:

NAT divert to egress interface inside

Untranslate 10.0.1.100/0 to 10.0.1.100/0

Phase: 5

Type: ACCESS-LIST

Subtype:

Result: DROP

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in  id=0xac7519f8, priority=0, domain=permit, deny=true

        hits=486, user_data=0x9, cs_id=0x0, use_real_addr, flags=0x1000, protocol=0

        src ip/id=0.0.0.0, mask=0.0.0.0, port=0

        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

        input_ifc=outside, output_ifc=any

Result:

input-interface: outside

input-status: up

input-line-status: up

output-interface: inside

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule

Super Bronze

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Hi,

It seems to drop on ACL check but I am not quite sure why it would

You have the default setting which doesnt require interface ACL check for traffic coming from a VPN Connection. You dont have any problems related to the "security-level" configuration on the ASA either.

For the Split Tunnel you could configure this

access-list SPLIT-TUNNEL standard permit 10.0.1.0 255.255.255.0

access-list SPLIT-TUNNEL standard permit 10.1.00 255.255.0.0

group-policy GroupPolicy_AnyConnect attributes

split-tunnel-policy tunnelspecified

split-tunnel-network-list value SPLIT-TUNNEL

Though after this the NAT configuration above is useless as Internet bound traffic should not arrive to the ASA anymore from the VPN client.

- Jouni

New Member

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Jouni,

The current config is included below.

I added the SPLIT-TUNNEL but it still isn't working and neither is the INSIDE - but I can work around that issue as I said.

If you notcie anything, let me know.

Thank you again,

Jerry

******************************************

ASA Version 8.4(4)

!

hostname mxfw

domain-name moxiefl.com

enable password $$$$$$$$$$$$$$$$$$$ encrypted

!

names

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

shutdown

!

interface Ethernet0/4

shutdown

!

interface Ethernet0/5

switchport trunk allowed vlan 20,22

switchport mode trunk

!

interface Ethernet0/6

shutdown

!

interface Ethernet0/7

shutdown

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

!

interface Vlan20

nameif dmz

security-level 50

ip address 172.26.20.1 255.255.255.0

!

interface Vlan22

nameif dmz2

security-level 50

ip address 172.26.22.1 255.255.255.0

!

ftp mode passive

dns domain-lookup inside

dns domain-lookup outside

dns server-group DefaultDNS

name-server 208.67.222.222

name-server 208.67.220.220

domain-name moxiefl.com

same-security-traffic permit inter-interface

object network Generic_All_Network

subnet 0.0.0.0 0.0.0.0

object network INSIDE_Hosts

subnet 10.1.0.0 255.255.0.0

object network AnyConnect_Hosts

subnet 192.168.60.0 255.255.255.0

object network NETWORK_OBJ_192.168.60.0_26

subnet 192.168.60.0 255.255.255.192

object network DMZ_Network

subnet 172.26.20.0 255.255.255.0

object network DMZ2_Network

subnet 172.26.22.0 255.255.255.0

object network INSIDE

subnet 10.0.1.0 255.255.255.0

access-list capdmz extended permit icmp host 172.26.20.22 host 208.67.222.222

access-list capdmz extended permit icmp host 208.67.222.222 host 172.26.20.22

access-list capout extended permit icmp host 192.168.1.231 host 208.67.222.222

access-list capout extended permit icmp host 208.67.222.222 host 192.168.1.231

access-list AnyConnect_Client_Local_Print extended deny ip any any

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd

access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631

access-list AnyConnect_Client_Local_Print remark Windows' printing port

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100

access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol

access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353

access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol

access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355

access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol

access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137

access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns

access-list SPLIT-TUNNEL standard permit 10.0.1.0 255.255.255.0

access-list SPLIT-TUNNEL standard permit 10.1.0.0 255.255.0.0

pager lines 24

mtu inside 1500

mtu outside 1500

mtu dmz 1500

mtu dmz2 1500

ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (inside,outside) source static INSIDE INSIDE destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup

nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.60.0_26 NETWORK_OBJ_192.168.60.0_26 no-proxy-arp route-lookup

nat (dmz,outside) source dynamic Generic_All_Network interface

nat (dmz2,outside) source dynamic Generic_All_Network interface

!

nat (inside,outside) after-auto source dynamic Generic_All_Network interface

route inside 10.1.0.0 255.255.0.0 10.0.1.2 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

http server enable

http 10.0.0.0 255.0.0.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec ikev2 ipsec-proposal DES

protocol esp encryption des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal 3DES

protocol esp encryption 3des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES

protocol esp encryption aes

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES192

protocol esp encryption aes-192

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES256

protocol esp encryption aes-256

protocol esp integrity sha-1 md5

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto ca trustpoint ASDM_TrustPoint0

enrollment self

fqdn anyconnect.moxiefl.com

subject-name CN=AnyConnect.moxiefl.com

keypair AnyConnect

proxy-ldc-issuer

crl configure

crypto ca certificate chain ASDM_TrustPoint0

certificate 439a4452

    3082026c 308201d5 a0030201 02020443 9a445230 0d06092a 864886f7 0d010105

    05003048 311f301d 06035504 03131641 6e79436f 6e6e6563 742e6d6f 78696566

    6c2e636f 6d312530 2306092a 864886f7 0d010902 1616616e 79636f6e 6e656374

    2e6d6f78 6965666c 2e636f6d 301e170d 31333039 32373037 32353331 5a170d32

    33303932 35303732 3533315a 3048311f 301d0603 55040313 16416e79 436f6e6e

    6563742e 6d6f7869 65666c2e 636f6d31 25302306 092a8648 86f70d01 09021616

    616e7963 6f6e6e65 63742e6d 6f786965 666c2e63 6f6d3081 9f300d06 092a8648

    86f70d01 01010500 03818d00 30818902 8181009a d9f320ff e93d4fdd cb707a4c

    b4664c47 6d2cc639 4dc45fed bfbc2150 7109fd81 5d6a5252 3d40dc43 696360d5

    fbf92bcc 477d19b8 5301085c daf40de5 87d7e4aa f81b8d7f 8d364dfa 0a6f07d7

    6a7c3e9b 56e69152 aa5492d8 e35537bd 567ccf29 7afbeae8 13da9936 9f890d76

    1d56d11d da3d039a 0e714849 e6841ff2 5483b102 03010001 a3633061 300f0603

    551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06

    03551d23 04183016 80142f27 7096c4c5 e396e691 e07ef737 af61b71f 64f1301d

    0603551d 0e041604 142f2770 96c4c5e3 96e691e0 7ef737af 61b71f64 f1300d06

    092a8648 86f70d01 01050500 03818100 8f777196 bbe6a5e4 8af9eb9a 514a8348

    5e62d6cd 47257243 e430a758 2b367543 065d4ceb 582bf666 08ff7be1 f89287a2

    ac527824 b11c2048 7fd2b50d 35ca3902 6aa00675 e4df7859 f3590596 b1d52426

    1e97a52c 4e77f4b0 226dec09 713f7ba9 80bdf7bb b52a7da2 4a68b91b 455cabba

    0cc4c6f3 f244f7d9 0a6e32fb 31ce7e35

  quit

crypto ikev2 policy 1

encryption aes-256

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 10

encryption aes-192

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 20

encryption aes

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 30

encryption 3des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 40

encryption des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 enable outside client-services port 443

crypto ikev2 remote-access trustpoint ASDM_TrustPoint0

telnet timeout 5

ssh 10.0.0.0 255.0.0.0 inside

ssh timeout 5

ssh key-exchange group dh-group1-sha1

console timeout 0

dhcpd dns 208.67.222.222 208.67.220.220

dhcpd auto_config outside

!

dhcpd address 10.0.1.20-10.0.1.40 inside

dhcpd dns 208.67.222.222 208.67.220.220 interface inside

dhcpd enable inside

!

dhcpd address 172.26.20.21-172.26.20.60 dmz

dhcpd dns 208.67.222.222 208.67.220.220 interface dmz

dhcpd enable dmz

!

dhcpd address 172.26.22.21-172.26.22.200 dmz2

dhcpd dns 208.67.222.222 208.67.220.220 interface dmz2

dhcpd enable dmz2

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ssl trust-point ASDM_TrustPoint0 outside

webvpn

enable outside

anyconnect-essentials

anyconnect image disk0:/anyconnect-win-3.0.2052-k9.pkg 1

anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml

anyconnect enable

tunnel-group-list enable

group-policy GroupPolicy_AnyConnect internal

group-policy GroupPolicy_AnyConnect attributes

wins-server none

dns-server value 208.67.222.222 208.67.220.220

vpn-tunnel-protocol ikev2 ssl-client

split-tunnel-network-list value SPLIT-TUNNEL

default-domain value moxiefl.com

webvpn

  anyconnect profiles value AnyConnect_client_profile type user

username user1 password $$$$$$$$$$$$$$$$$ encrypted privilege 15

username user2 password $$$$$$$$$$$$$$$$ encrypted privilege 15

tunnel-group AnyConnect type remote-access

tunnel-group AnyConnect general-attributes

address-pool VPN_POOL

default-group-policy GroupPolicy_AnyConnect

tunnel-group AnyConnect webvpn-attributes

group-alias AnyConnect enable

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip

  inspect xdmcp

  inspect icmp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:f6b360b6e7e6a1a6a278d36a506358c2

: end

New Member

AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside netw

Jouni,

Interesting new information.

I can ping the L3 switch Gateway address for the VLAN - 10.1.10.1 from the VPN computer, but I cannot ping a computer connected to the VLAN 10.1.10.23. I am going to build a capture to try to see the data to and from the VPN to the INSIDE Host.

Jerry

2953
Views
10
Helpful
25
Replies
CreatePlease login to create content