2

I have setup ASA5506 for cisco anyconnect VPN and i am able to connect VPN but not able to ping or ssh or anything to any device on remote lan (inside) network 10.0.10.x/24

Here is the network diagram:

enter image description here

Configuration:

ASA Version 9.8(2)
!
hostname asa0
enable password <secret>
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
names
ip local pool ANYCONNECT-POOL 10.0.11.1-10.0.11.254 mask 255.255.255.0

!
interface GigabitEthernet1/1
 nameif inside
 security-level 100
 ip address 10.0.10.1 255.255.255.0
!
interface GigabitEthernet1/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/6
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/7
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/8
 description Internet-ISP
 nameif outside
 security-level 0
 ip address 71.100.102.210 255.255.255.0
!
interface Management1/1
 management-only
 shutdown
 no nameif
 security-level 100
 no ip address
!
boot system disk0:/asa982-lfbff-k8.SPA
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup inside
dns server-group DefaultDNS
 name-server 10.0.10.10
 name-server 10.0.10.11
object network VPN-ANYCONNECT-SUBNET
 subnet 10.0.11.0 255.255.255.0
object-group network NET-SITE0-SUBNETS
 network-object 10.0.10.0 255.255.255.0
 network-object 10.0.11.0 255.255.255.0
object-group network NET-VPN-POOL
 network-object 10.0.11.0 255.255.255.0
access-list ANYCONNECT-ROUTES-FOO-EMPLOYEE standard permit 10.0.0.0 255.0.0.0
access-list OUTSIDE_IN extended permit icmp any any
pager lines 24
logging enable
logging timestamp
logging buffer-size 16384
logging buffered informational
logging asdm errors
mtu inside 1500
mtu outside 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 10 burst-size 5
icmp permit any outside
asdm image disk0:/asdm-741.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 32768
nat (any,outside) source static NET-VPN-POOL NET-VPN-POOL destination static NET-SITE0-SUBNETS NET-SITE0-SUBNETS
!
nat (any,outside) after-auto source dynamic NET-SITE0-SUBNETS interface
access-group OUTSIDE_IN in interface outside
route outside 0.0.0.0 0.0.0.0 71.100.102.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:01:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication login-history
http server enable
no snmp-server location
no snmp-server contact
sysopt connection tcpmss 1379
service sw-reset-button
crypto ca trustpoint FOO_Wildcard_2016
 keypair FOO_Wildcard_2016
 crl configure
crypto ca trustpoint CA_Bundle
 enrollment terminal
 crl configure
crypto ca trustpool policy
crypto ca certificate chain FOO_Wildcard_2016
 certificate 25e70b9d51d92b2c
    3082051c 30820404 a0030201 02020825 e70b9d51 d92b2c30 0d06092a 864886f7
    …
   <output omitted>
    …
    469628ad a1267d0a 09a72e04 a38dbcf8 bc043001
  quit
telnet timeout 5
ssh stricthostkeycheck
ssh 10.0.0.0 255.0.0.0 inside
ssh timeout 15
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
management-access inside

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point FOO_Wildcard outside
webvpn
 enable outside
 anyconnect image disk0:/anyconnect-win-4.5.01044-webdeploy-k9.pkg 1
 anyconnect image disk0:/anyconnect-macos-4.5.01044-webdeploy-k9.pkg 2
 anyconnect image disk0:/anyconnect-linux64-4.5.01044-webdeploy-k9.pkg 3
 anyconnect enable
 tunnel-group-list enable
 cache
  disable
 error-recovery disable
group-policy GroupPolicy_ANYCONNECT-FOO-EMPLOYEE internal
group-policy GroupPolicy_ANYCONNECT-FOO-EMPLOYEE attributes
 dns-server value 10.0.10.1 10.0.10.10
 vpn-tunnel-protocol ssl-client
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value ANYCONNECT-ROUTES-FOO-EMPLOYEE
 default-domain value FOO.com
dynamic-access-policy-record DfltAccessPolicy
tunnel-group FOO-EMPLOYEE type remote-access
tunnel-group FOO-EMPLOYEE general-attributes
 address-pool ANYCONNECT-POOL
 default-group-policy GroupPolicy_ANYCONNECT-FOO-EMPLOYEE
tunnel-group FOO-EMPLOYEE webvpn-attributes
 group-alias FOO-EMPLOYEE enable
!
class-map inspection_default
 match default-inspection-traffic
class-map NOTIMEOUT_class
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
policy-map global_policy
 class inspection_default
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
  inspect dns preset_dns_map
  inspect icmp
policy-map type inspect dns migrated_dns_map_1
 parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
!
service-policy global_policy global
prompt hostname context
: end
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Feb 21 '18 at 18:23
2

Solution

Nevermind i figured it out, it was nat rule missing (inside,outside)

nat (inside,outside) source static any any destination static NET-VPN-POOL NET-VPN-POOL no-proxy-arp route-lookup
  • 1
    Your NAT of nat (any,outside) source static NET-VPN-POOL NET-VPN-POOL destination static NET-SITE0-SUBNETS NET-SITE0-SUBNETS is NOT correct. The one you you added later in the answer is better. However, I would use source static NET-SITE0-SUBNETS NET-SITE0-SUBNETS rather than source static any any. – Hung Tran Dec 16 '17 at 19:52
  • why not source static any any ?? – Satish Dec 16 '17 at 19:58
  • You should limit the sources IPs to what you actually have in your network. – Hung Tran Dec 16 '17 at 20:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.