Hello all,
I am having the hardest time with getting VPN clients access to ICMP into the internal network behind the FW. I have tested HTTP and SSH fine for inbound VPN client connections, but their pings fail always. They seem to hit their destinations, but are blocked on the return for some reason. Packet-Tracer states it is due to an ACL rule, but I have no applied at the moment, as I am labbing up a new system for deployment. Any help would be great.
packet-tracer input outside icmp 10.0.4.130 8 0 11 10.0.12.1
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 10.0.12.0 255.255.255.252 Inside
Phase: 2
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (Outside,Inside) source static ANYCONNECT_VPNs ANYCONNECT_VPNs
Additional Information:
Phase: 3
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Phase: 4
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Result:
input-interface: Outside
input-status: up
input-line-status: up
output-interface: Inside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
the reverse works though:
HJSHS-A106-ASA(config)# packet-tracer input outside icmp 10.0.12.1 0 8 11 10.0$
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 10.0.4.130 255.255.255.255 Outside
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Phase: 3
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 5
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:
Phase: 6
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:
Phase: 7
Type: WEBVPN-SVC
Subtype: out
Result: ALLOW
Config:
Additional Information:
Phase: 8
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 3204, packet dispatched to next module
Result:
input-interface: Outside
input-status: up
input-line-status: up
output-interface: Outside
output-status: up
output-line-status: up
Action: allow
=======================================
Here is the config:
access-list Split-Tunnel remark Total LAN Network
access-list Split-Tunnel standard deny 10.0.4.96 255.255.255.224
access-list Split-Tunnel standard deny 10.0.4.128 255.255.255.224
access-list Split-Tunnel standard permit 10.0.0.0 255.255.0.0
access-list test extended permit ip any any log
access-group test in interface Inside
access-group test out interface Inside
interface Port-channel12
nameif Inside
security-level 100
ip address 10.0.12.2 255.255.255.252
!
interface Port-channel14
nameif Outside
security-level 1
ip address <removed> 255.255.255.248
Port-channel12 10.0.12.2 YES CONFIG up up
Port-channel14 <removed> YES CONFIG up up
ip local pool TEACHER_VPN 10.0.4.98-10.0.4.126 mask 255.255.255.224
ip local pool IT_VPN 10.0.4.130-10.0.4.158 mask 255.255.255.224
Below is more of the config:
boot system disk0:/asa912-smp-k8.bin
ftp mode passive
same-security-traffic permit intra-interface
object-group service internet-udp udp
description UDP Standard Internet Services
port-object eq domain
port-object eq ntp
port-object eq isakmp
port-object eq 4500
object-group service Internet-tcp tcp
description TCP Standard Internet Services
port-object eq www
port-object eq https
port-object eq smtp
port-object eq 465
port-object eq pop3
port-object eq 995
port-object eq ftp
port-object eq ftp-data
port-object eq domain
port-object eq ssh
port-object eq telnet
object-group network NAT_SOURCE
network-object 10.0.0.0 255.255.0.0
object-group network ANYCONNECT_VPNs
network-object 10.0.4.128 255.255.255.224
network-object 10.0.4.96 255.255.255.224
nat (Inside,Outside) source dynamic NAT_SOURCE interface
nat (Outside,Inside) source static ANYCONNECT_VPNs ANYCONNECT_VPNs
nat (Inside,Inside) source static ANYCONNECT_VPNs ANYCONNECT_VPNs
nat (Inside,Inside) source static NAT_SOURCE NAT_SOURCE
route Outside 0.0.0.0 0.0.0.0 <removed> 1
route Inside 10.0.0.0 255.255.0.0 10.0.12.1 1
route Inside 172.30.0.0 255.255.0.0 10.0.12.1 1
http server enable
http 172.30.0.0 255.255.0.0 Inside
http redirect Outside 80
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map Outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map Outside_map interface Outside
crypto ca trustpool policy
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable Outside client-services port 443
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 Inside
ssh timeout 20
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 20
management-access Inside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
enable Outside
anyconnect image disk0:/anyconnect-win-3.1.05160-k9.pkg 1
anyconnect enable
tunnel-group-list enable
group-policy GroupPolicy_IT internal
group-policy GroupPolicy_IT attributes
wins-server none
dns-server value 8.8.8.8
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Split-Tunnel
default-domain value <removed>
address-pools value IT_VPN
group-policy GroupPolicy_Teachers internal
group-policy GroupPolicy_Teachers attributes
wins-server none
dns-server value 8.8.8.8
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Split-Tunnel
default-domain value <removed>
address-pools value TEACHER_VPN
username admin password <removed> encrypted privilege 15
tunnel-group TunnelGroup_IT type remote-access
tunnel-group TunnelGroup_IT general-attributes
address-pool IT_VPN
default-group-policy GroupPolicy_IT
tunnel-group TunnelGroup_IT webvpn-attributes
group-alias IT_Workers enable
tunnel-group TunnelGroup_Teachers type remote-access
tunnel-group TunnelGroup_Teachers general-attributes
address-pool TEACHER_VPN
default-group-policy GroupPolicy_Teachers
tunnel-group TunnelGroup_Teachers webvpn-attributes
group-alias Teachers enable
!
class-map inspection_additional
match port tcp eq ssh
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
class inspection_additional
Here are some of the connection logs from a switch I used which sits behind the ASA:
*May 7 12:48:14.342: FIBipv4-packet-proc: route packet from Vlan100 src 10.0.4.130 dst 10.0.12.1
*May 7 12:48:14.342: FIBfwd-proc: Default:10.0.12.1/32 receive entry
*May 7 12:48:14.342: FIBipv4-packet-proc: packet routing failed
*May 7 12:48:14.342: IP: s=10.0.4.130 (Vlan100), d=10.0.12.1, len 52, rcvd 2
*May 7 12:48:14.342: TCP src=50891, dst=443, seq=2731020968, ack=0, win=8192 SYN
*May 7 12:48:14.342: IP: s=10.0.4.130 (Vlan100), d=10.0.12.1, len 52, stop process pak for forus packet
*May 7 12:48:14.342: TCP src=50891, dst=443, seq=2731020968, ack=0, win=8192 SYN
*May 7 12:48:14.342: IP: s=10.0.12.1 (local), d=10.0.4.130, len 40, local feature
*May 7 12:48:14.342: TCP src=443, dst=50891, seq=0, ack=2731020969, win=0 ACK RST, Local Clustering(8), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*May 7 12:48:14.342: FIBipv4-packet-proc: route packet from (local) src 10.0.12.1 dst 10.0.4.130
*May 7 12:48:14.342: FIBfwd-proc: packet routed by adj to Vlan100 10.0.4.130
*May 7 12:48:14.342: FIBipv4-packet-proc: packet routing succeeded
*May 7 12:48:14.342: IP: tableid=0, s=10.0.12.1 (local), d=10.0.4.130 (Vlan100), routed via FIB
*May 7 12:48:14.342: IP: s=10.0.12.1 (local), d=10.0.4.130 (Vlan100), len 40, sending
*May 7 12:48:14.342: TCP src=443, dst=50891, seq=0, ack=2731020969, win=0 ACK RST
*May 7 12:48:14.342: IP: s=10.0.12.1 (local), d=10.0.4.130 (Vlan100), len 40, sending full packet
*May 7 12:48:14.342: TCP src=443, dst=50891, seq=0, ack=2731020969, win=0 ACK RST
*May 7 12:48:14.436: IP: s=10.0.12.1 (local), d=10.0.4.130, len 56, local feature
*May 7 12:48:14.436: ICMP type=11, code=0, Local Clustering(8), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE
*May 7 12:48:14.436: FIBipv4-packet-proc: route packet from (local) src 10.0.12.1 dst 10.0.4.130
*May 7 12:48:14.436: FIBfwd-proc: packet routed by adj to Vlan100 10.0.4.130
*May 7 12:48:14.436: FIBipv4-packet-proc: packet routing succeeded
*May 7 12:48:14.436: IP: tableid=0, s=10.0.12.1 (local), d=10.0.4.130 (Vlan100), routed via FIB
*May 7 12:48:14.436: IP: s=10.0.12.1 (local), d=10.0.4.130 (Vlan100), len 56, sending
*May 7 12:48:14.436: ICMP type=11, code=0
Again, the Client can connect through http/s, but ICMP isn't working which will be important for their IT in the future.
