Anyconnect with ASA5520 issues

[Adrian Ardelean]

Hi,

I set up Remote access VPN, I get connected but no traffic.

From packet tracer seems to be OK.

Any ideeas?

Thanks!

[Jennifer Halim]

You would need to configure NAT exemption as follows:

object network obj-172.16.5.0

   subnet 172.16.5.0 255.255.255.0

object network obj-172.16.0.0

   subnet 172.16.0.0 255.255.255.224

object network obj-172.16.2.0

   subnet 172.16.2.0 255.255.254.0

object network vpn-pool

   subnet 172.16.200.0 255.255.255.0

nat (LAN-Servers,External) source static obj-172.16.5.0 obj-172.16.5.0 destination static vpn-pool vpn-pool

nat (LAN-IT,External) source static obj-172.16.0.0 obj-172.16.0.0 destination static vpn-pool vpn-pool

nat (LAN-GenPop,External) source static obj-172.16.2.0 obj-172.16.2.0 destination static vpn-pool vpn-pool

[Adrian Ardelean]

Thank you.

I'm afraid it's not working, same thing like before

Now I have this:

[Jennifer Halim]

How are you trying to test? Did you use ping?

If you do, please also add the following:

policy-map global_policy
class inspection_default

   inspect icmp

And are you able to ping 172.16.0.29 after connected through AnyConnect?

[Adrian Ardelean]

I tried with ping, nothing.

I added those, still nothing.

i can't ping anything, not even 172.16.0.29.

But now, in packet tracer I have this:

Thank you!

[Jose L. Berlanga V.]

You need to declarate the network routes for the inside network. Can you put the show output of the command "debug crypto ipsec sa"???

Saludos,
Jose Luis B.
No te olvides de calificar si te sirvio la ayuda.
Please do rate if the given information helps.

[Adrian Ardelean]

No output on "debug crypto ipsec". (with sa it gives me an error)

[Jennifer Halim]

well, this is AnyConnect, so the "debug cry ipsec" is incorrect debug to use.

Can you please connect via AnyConnect, and share the output of statistics and also the route from the AnyConnect client.

Also, pls share the latest config after the changes.

[Adrian Ardelean]

This is what I have:

[Jennifer Halim]

On the ASA, can you please share the details of the following once you connected through the AnyConnect and ping something:

show vpn-sessiondb detail anyconnect

[Adrian Ardelean]

Yes sir!

Here you have: