ASA version 9.1 configured with SSL VPN to Windows AnyConnect Secure Mobility Client version 3.1. VPN Filter ACL is configured to allow all traffic and ICMP, and is attached to group policy.
VPN connects successfully (AnyConnect client says "connected") but cannot route any traffic over the VPN. Cannot ping any internal host behind the ASA,
Internal network (behind ASA): 10.111.11.0/24 Network on client computer: 192.168.1.0/24 (sits behind another ASA - that is not relevant though because doesn't work on other n/w having no ASA firewall either)
ASDM reports one AnyConnect session active on the ASA. Reports also that the above ACL is going to be used. The first rule of that ACL (see below config) got 1900 hits so traffic arrives but seems to not find its way back? VPN ACLs are meant to automatically be bidirectional so it SHOULD work.
On the Windows client computer I can see a Cisco network adapter has been created when the VPN connects with IP address 192.168.20.1. Network configuration claims that 192.168.20.2 is the default gateway, which should be the ASA - but I cannot ping 192.168.20.2. A "route print" on the client computer shows 192.168.20.2 to be the default gateway as well. (These addresses are valid - they are assigned from local pool RemoteWorkerPool 192.168.20.1-192.168.20.254, see below config).
I cannot ping the client IP address (192.168.20.1) from within the ASA (does the AnyConnect client respond to the ping usually?)
Running a "show vpn-sessiondb detail svc filter name " command shows "Filter name: RemoteVPNACL" in the SSL section, which fits to my configuration - the ACL is being used.
A "show ssl" command brings up the following:
Accept connections using SSLv2, SSLv3 or TLSv1 and negotiate to SSLv3 or TLSv1 Start connections using SSLv3 and negotiate to SSLv3 or TLSv1 Enabled cipher order: rc4-sha1 dhe-aes128-sha1 dhe-aes256-sha1 aes128-sha1 aes256-sha1 3des-sha1 Disabled ciphers: des-sha1 rc4-md5 null-sha1 SSL trust-points: outside interface: TrustPoint1 NP Identity Ifc interface: Certificate authentication is not enabled
This also seems okay - I use username / password authentication. I could not find anything in Cisco documentation that the 3.1 client would not work with ASA version 9.1, but it's not 100% clear.
Configuration was originally created by ASDM wizard and resulted in this problem. Have re-created the configuration plainly from CLI, same result.
Connected the Windows client to another internet connection which is not behind any firewall. Same result - VPN connects but no traffic can flow.
Have configured IPSec VPN for AnyConnect on top of this configuration - same result, I get a connection, but no traffic flows.
The Cisco VPN troubleshooter did not give me any useful hint.
I am sure there is a very basic error somehwere, but cannot find it. I am lacking knowledge on how one goes about debugging or troubleshooting AnyConnect VPN connections apart from above.
Configuration (relevant parts):
crypto key generate rsa label RSA_KEYPAIR noconfirm crypto ca trustpoint TrustPoint1 revocation-check none id-usage ssl-ipsec no fqdn subject-name CN=ASA enrollment self keypair RSA_KEYPAIR crypto ca enroll TrustPoint1 noconfirm ssl trust-point TrustPoint1 outside ip local pool RemoteWorkerPool 192.168.20.1-192.168.20.254 sysopt connection permit-vpn access-list RemoteVPNACL permit ip 192.168.20.0 255.255.255.0 any access-list RemoteVPNACL permit icmp 192.168.20.0 255.255.255.0 any group-policy RemoteWorkerPolicy internal group-policy RemoteWorkerPolicy attributes vpn-tunnel-protocol ssl-client address-pools value RemoteWorkerPool vpn-filter value RemoteVPNACL dns-server value 10.111.11.5 vpn-idle-timeout 30 username nepclientvpn password xxxxxxxxxxxxx username nepclientvpn attributes vpn-group-policy RemoteWorkerPolicy tunnel-group vpnclient type remote-access tunnel-group vpnclient general-attributes address-pool RemoteWorkerPool default-group-policy RemoteWorkerPolicy tunnel-group vpnclient webvpn-attributes group-alias nepRemote1 enable webvpn tunnel-group-list enable anyconnect image disk0:/anyconnect-win-3.1.05182-k9.pkg 1 anyconnect image disk0:/anyconnect-macosx-i386-3.1.05160-k9.pkg 2 enable outside anyconnect enable