2

VPN clients are trying to connect to the outside interface of the ASA (in the lab) https:// 10.177.5.40 -> the browser gets into an infinite loading state and suddenly after 10-20 min loads any connect client successfully. I doubt is browser/operating system issue since until yesterday war working fine. A ping -n 1000 does not indicate any issues with the connection. (all pings are <1ms).
Things i tried: I reset all vpn configuration 3 times and did it from scratch. I also tried the wizard

    ASA Version 8.4(2) 
!
hostname Team4-RTR-01
domain-name Team4.com
enable password GqkDZRy1QiuwlSAZ encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0 
!
interface Ethernet0/1
 nameif DMZ
 security-level 50
 ip address 192.168.20.1 255.255.255.0 
!
interface Ethernet0/2
 nameif outside
 security-level 0
 ip address 10.177.5.40 255.255.255.0 
!
interface Ethernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 nameif management
 security-level 100
 ip address 192.168.10.1 255.255.255.0 
 management-only
!
banner motd This is a secure device. Unothorized access users will be pursecutd to the full extend of law.
boot system disk0:/asa842-k8.bin
ftp mode passive
dns domain-lookup inside
dns domain-lookup DMZ
dns domain-lookup outside
dns domain-lookup management
dns server-group DefaultDNS
 domain-name Team4.com
same-security-traffic permit intra-interface
object service FTP
 service tcp destination eq ftp 
object service FTPDATA
 service tcp destination eq ftp-data 
object service HTTP
 service tcp destination eq www 
object network DMZ_FTP
 host 192.168.20.2
object network DMZ_FTP_DATA
 host 192.168.20.2
object network DMZ_HTTP
 host 192.168.20.2
object network INSIDE
 subnet 192.168.1.0 255.255.255.0
object network DMZ
 subnet 192.168.20.0 255.255.255.0
object network TEAM4SRV_FTP
 host 192.168.20.2
object network TEAM4FTP_DATA
 host 192.168.20.2
object network NETWORK_OBJ_192.168.1.0_24
 subnet 192.168.1.0 255.255.255.0
object network TEAM4SRV
 host 192.168.20.2
object-group service Server tcp
 description ServerServices
 port-object eq ftp
 port-object eq ftp-data
 port-object eq www
 port-object eq https
object-group user DM_INLINE_USER_1
 user LOCAL\kriss
 user LOCAL\alberto
 user LOCAL\user1
object-group service DMZ_SERVICES tcp
 port-object eq ftp
 port-object eq ftp-data
 port-object eq www
 port-object eq https
object-group icmp-type all
 icmp-object alternate-address
 icmp-object conversion-error
 icmp-object echo
 icmp-object echo-reply
 icmp-object information-reply
 icmp-object information-request
 icmp-object mask-reply
 icmp-object mask-request
 icmp-object mobile-redirect
 icmp-object parameter-problem
 icmp-object redirect
 icmp-object router-advertisement
 icmp-object router-solicitation
 icmp-object source-quench
 icmp-object time-exceeded
 icmp-object timestamp-reply
 icmp-object timestamp-request
 icmp-object traceroute
 icmp-object unreachable
object-group service Radius udp
 port-object eq 1812
 port-object eq 1813
object-group service DM_INLINE_UDP_1 udp
 group-object Radius
 port-object eq radius
 port-object eq radius-acct
object-group service DMZ_OUTS tcp
 group-object DMZ_SERVICES
access-list inside_access_in extended permit udp any host 192.168.20.2 object-group DM_INLINE_UDP_1 
access-list inside_access_in extended permit tcp any any eq ssh 
access-list inside_access_in extended permit icmp any interface outside object-group all 
access-list inside_access_in extended permit icmp any any object-group all 
access-list Vpnsplittunnel standard permit 192.168.1.0 255.255.255.0 
access-list outside_VPN extended permit ip object-group-user DM_INLINE_USER_1 any interface inside 
access-list outside_access_in extended permit tcp 10.177.5.0 255.255.255.0 host 192.168.20.2 object-group DMZ_SERVICES 
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu DMZ 1500
mtu outside 1500
mtu management 1500
ip local pool VPNpool 192.168.1.100-192.168.1.200 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit 192.168.20.0 255.255.255.0 inside
icmp permit 192.168.1.0 255.255.255.0 inside
icmp permit 192.168.1.0 255.255.255.0 DMZ
icmp permit 192.168.20.0 255.255.255.0 DMZ
asdm history enable
arp timeout 14400
nat (inside,outside) source static INSIDE INSIDE destination static INSIDE INSIDE
!
object network INSIDE
 nat (inside,outside) dynamic interface
object network DMZ
 nat (DMZ,outside) dynamic interface
object network TEAM4SRV_FTP
 nat (DMZ,outside) static interface service tcp ftp ftp 
object network TEAM4FTP_DATA
 nat (DMZ,outside) static interface service tcp ftp-data ftp-data 
object network TEAM4SRV
 nat (DMZ,outside) static interface service tcp www www 
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server RADIUSSERVICE protocol radius
aaa-server RADIUSSERVICE (DMZ) host 192.168.20.3
 key 8 UEoeA/tsg6z2QuaAy0bsBrMUaJNBYq1o5DMu9+1GHw==
 authentication-port 1812
 accounting-port 1813
user-identity default-domain LOCAL
http server enable
http 192.168.10.0 255.255.255.0 management
http 192.168.1.0 255.255.255.0 inside
http 10.0.0.0 255.0.0.0 outside
http 192.168.20.0 255.255.255.0 DMZ
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac 
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac 
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac 
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac 
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac 
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac 
crypto ipsec ikev2 ipsec-proposal DES
 protocol esp encryption des
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
 protocol esp encryption 3des
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
 protocol esp encryption aes
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
 protocol esp encryption aes-192
 protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
 protocol esp encryption aes-256
 protocol esp integrity sha-1 md5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint ASDM_TrustPoint0
 enrollment self
 subject-name CN=Team4-RTR-01
 keypair def2
 proxy-ldc-issuer
 crl configure
crypto ca certificate chain ASDM_TrustPoint0
 certificate deadbeef01
    abcdefg
  quit
crypto ikev2 policy 1
 encryption aes-256
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 10
 encryption aes-192
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 20
 encryption aes
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 30
 encryption 3des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 policy 40
 encryption des
 integrity sha
 group 5 2
 prf sha
 lifetime seconds 86400
crypto ikev2 enable outside client-services port 443
crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication crack
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 20
 authentication rsa-sig
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 30
 authentication pre-share
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 40
 authentication crack
 encryption aes-192
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 50
 authentication rsa-sig
 encryption aes-192
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 60
 authentication pre-share
 encryption aes-192
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 70
 authentication crack
 encryption aes
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 80
 authentication rsa-sig
 encryption aes
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 90
 authentication pre-share
 encryption aes
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 100
 authentication crack
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 110
 authentication rsa-sig
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 120
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 130
 authentication crack
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 140
 authentication rsa-sig
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto ikev1 policy 150
 authentication pre-share
 encryption des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
management-access inside
dhcpd address 192.168.1.20-192.168.1.99 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
tftp-server inside 192.168.1.10 anyconnect-win-3.1.00495-k9.pkg
ssl trust-point ASDM_TrustPoint0 outside
webvpn
 enable outside
 no anyconnect-essentials
 csd image disk0:/csd_3.6.6249-k9.pkg
 csd hostscan image disk0:/hostscan_3.1.04060-k9.pkg
 csd enable
 anyconnect image disk0:/anyconnect-win-3.1.00495-k9.pkg 1
 anyconnect image disk0:/anyconnect-linux-3.1.00495-k9.pkg 2
 anyconnect image disk0:/anyconnect-macosx-i386-3.1.00495-k9.pkg 3
 anyconnect profiles Test_client_profile disk0:/Test_client_profile.xml
 anyconnect profiles anyconnectprofile disk0:/anyconnectprofile.xml
 anyconnect enable
 tunnel-group-list enable
group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
 default-domain value Team4.com
group-policy VPNTracking internal
group-policy VPNTracking attributes
 vpn-tunnel-protocol ikev1 l2tp-ipsec 
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value Vpnsplittunnel
 address-pools value VPNpool
username user1 password foobarme nt-encrypted
username user1 attributes
 vpn-group-policy VPNTracking
tunnel-group DefaultWEBVPNGroup general-attributes
 authentication-server-group RADIUSSERVICE LOCAL
 secondary-authentication-server-group RADIUSSERVICE
tunnel-group DefaultWEBVPNGroup webvpn-attributes
 group-alias DefualtWEBVpnAlias enable
tunnel-group VPNTracker type remote-access
tunnel-group VPNTracker general-attributes
 default-group-policy VPNTracking
tunnel-group VPNTracker ipsec-attributes
 ikev1 pre-shared-key 8 z0WDcMlMw7/+alToidyipWBfRUkb7fD6UsnoC6iu
!
class-map global-class
 match port udp range 1812 1813
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 description Radius
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
  inspect ip-options 
  inspect icmp 
  inspect icmp error 
 class global-class
  inspect ip-options 
!
service-policy global_policy global
prompt hostname context 
no call-home reporting anonymous
password encryption aes
hpm topN enable
Cryptochecksum:fce108bc42addd8ecca618ea1f6d8672
: end

Logs:

6|Aug 12 2013|11:59:46|725007|10.177.5.80|50673|||SSL session with client outside:10.177.5.80/50673 terminated.
6|Aug 12 2013|11:59:46|302014|10.177.5.80|50673|10.177.5.40|443|Teardown TCP connection 2288 for outside:10.177.5.80/50673 to identity:10.177.5.40/443 duration 0:00:08 bytes 12563 TCP Reset-O
6|Aug 12 2013|11:59:45|725002|10.177.5.80|50677|||Device completed SSL handshake with client outside:10.177.5.80/50677
6|Aug 12 2013|11:59:45|725001|10.177.5.80|50677|||Starting SSL handshake with client outside:10.177.5.80/50677 for TLSv1 session.
6|Aug 12 2013|11:59:45|302013|10.177.5.80|50677|10.177.5.40|443|Built inbound TCP connection 2295 for outside:10.177.5.80/50677 (10.177.5.80/50677) to identity:10.177.5.40/443 (10.177.5.40/443)
6|Aug 12 2013|11:59:45|106015|10.177.5.80|50676|10.177.5.40|443|Deny TCP (no connection) from 10.177.5.80/50676 to 10.177.5.40/443 flags FIN ACK  on interface outside
6|Aug 12 2013|11:59:45|302014|10.177.5.80|50676|10.177.5.40|443|Teardown TCP connection 2291 for outside:10.177.5.80/50676 to identity:10.177.5.40/443 duration 0:00:05 bytes 1251 TCP Reset-O
6|Aug 12 2013|11:59:45|725007|10.177.5.80|50676|||SSL session with client outside:10.177.5.80/50676 terminated.
6|Aug 12 2013|11:59:42|106015|10.177.5.80|50671|10.177.5.40|443|Deny TCP (no connection) from 10.177.5.80/50671 to 10.177.5.40/443 flags FIN PSH ACK  on interface outside
6|Aug 12 2013|11:59:40|106015|10.177.5.80|50671|10.177.5.40|443|Deny TCP (no connection) from 10.177.5.80/50671 to 10.177.5.40/443 flags FIN PSH ACK  on interface outside
6|Aug 12 2013|11:59:40|725002|10.177.5.80|50676|||Device completed SSL handshake with client outside:10.177.5.80/50676
6|Aug 12 2013|11:59:40|725001|10.177.5.80|50676|||Starting SSL handshake with client outside:10.177.5.80/50676 for TLSv1 session.
6|Aug 12 2013|11:59:40|302013|10.177.5.80|50676|10.177.5.40|443|Built inbound TCP connection 2291 for outside:10.177.5.80/50676 (10.177.5.80/50676) to identity:10.177.5.40/443 (10.177.5.40/443)
6|Aug 12 2013|11:59:39|106015|10.177.5.80|50671|10.177.5.40|443|Deny TCP (no connection) from 10.177.5.80/50671 to 10.177.5.40/443 flags FIN PSH ACK  on interface outside
6|Aug 12 2013|11:59:38|106015|10.177.5.80|50671|10.177.5.40|443|Deny TCP (no connection) from 10.177.5.80/50671 to 10.177.5.40/443 flags FIN PSH ACK  on interface outside
6|Aug 12 2013|11:59:38|725002|10.177.5.80|50673|||Device completed SSL handshake with client outside:10.177.5.80/50673
6|Aug 12 2013|11:59:38|725001|10.177.5.80|50673|||Starting SSL handshake with client outside:10.177.5.80/50673 for TLSv1 session.
6|Aug 12 2013|11:59:38|302013|10.177.5.80|50673|10.177.5.40|443|Built inbound TCP connection 2288 for outside:10.177.5.80/50673 (10.177.5.80/50673) to identity:10.177.5.40/443 (10.177.5.40/443)
6|Aug 12 2013|11:59:38|106015|10.177.5.80|50671|10.177.5.40|443|Deny TCP (no connection) from 10.177.5.80/50671 to 10.177.5.40/443 flags FIN ACK  on interface outside
6|Aug 12 2013|11:59:38|302014|10.177.5.80|50671|10.177.5.40|443|Teardown TCP connection 2285 for outside:10.177.5.80/50671 to identity:10.177.5.40/443 duration 0:00:01 bytes 8905 TCP Reset-O
6|Aug 12 2013|11:59:38|725007|10.177.5.80|50671|||SSL session with client outside:10.177.5.80/50671 terminated.
6|Aug 12 2013|11:59:37|725002|10.177.5.80|50671|||Device completed SSL handshake with client outside:10.177.5.80/50671
6|Aug 12 2013|11:59:37|725001|10.177.5.80|50671|||Starting SSL handshake with client outside:10.177.5.80/50671 for TLSv1 session.
6|Aug 12 2013|11:59:37|106015|10.177.5.80|50670|10.177.5.40|443|Deny TCP (no connection) from 10.177.5.80/50670 to 10.177.5.40/443 flags FIN ACK  on interface outside
6|Aug 12 2013|11:59:37|302013|10.177.5.80|50671|10.177.5.40|443|Built inbound TCP connection 2285 for outside:10.177.5.80/50671 (10.177.5.80/50671) to identity:10.177.5.40/443 (10.177.5.40/443)
6|Aug 12 2013|11:59:37|302014|10.177.5.80|50670|10.177.5.40|443|Teardown TCP connection 2284 for outside:10.177.5.80/50670 to identity:10.177.5.40/443 duration 0:00:05 bytes 1251 TCP Reset-O
6|Aug 12 2013|11:59:37|725007|10.177.5.80|50670|||SSL session with client outside:10.177.5.80/50670 terminated.
6|Aug 12 2013|11:59:35|302014|10.177.5.80|50664|10.177.5.40|443|Teardown TCP connection 2282 for outside:10.177.5.80/50664 to identity:10.177.5.40/443 duration 0:00:05 bytes 1109 TCP Reset-I
6|Aug 12 2013|11:59:35|725007|10.177.5.80|50664|||SSL session with client outside:10.177.5.80/50664 terminated.
6|Aug 12 2013|11:59:31|725007|10.177.5.80|50654|||SSL session with client outside:10.177.5.80/50654 terminated.
6|Aug 12 2013|11:59:31|302014|10.177.5.80|50654|10.177.5.40|443|Teardown TCP connection 2281 for outside:10.177.5.80/50654 to identity:10.177.5.40/443 duration 0:03:17 bytes 37709 TCP Reset-O
6|Aug 12 2013|11:59:31|725002|10.177.5.80|50670|||Device completed SSL handshake with client outside:10.177.5.80/50670
6|Aug 12 2013|11:59:31|725001|10.177.5.80|50670|||Starting SSL handshake with client outside:10.177.5.80/50670 for TLSv1 session.
6|Aug 12 2013|11:59:31|302013|10.177.5.80|50670|10.177.5.40|443|Built inbound TCP connection 2284 for outside:10.177.5.80/50670 (10.177.5.80/50670) to identity:10.177.5.40/443 (10.177.5.40/443)
6|Aug 12 2013|11:59:29|725002|10.177.5.80|50665|||Device completed SSL handshake with client outside:10.177.5.80/50665
6|Aug 12 2013|11:59:29|725002|10.177.5.80|50664|||Device completed SSL handshake with client outside:10.177.5.80/50664
6|Aug 12 2013|11:59:29|725001|10.177.5.80|50665|||Starting SSL handshake with client outside:10.177.5.80/50665 for TLSv1 session.
6|Aug 12 2013|11:59:29|725001|10.177.5.80|50664|||Starting SSL handshake with client outside:10.177.5.80/50664 for TLSv1 session.
6|Aug 12 2013|11:59:29|302013|10.177.5.80|50665|10.177.5.40|443|Built inbound TCP connection 2283 for outside:10.177.5.80/50665 (10.177.5.80/50665) to identity:10.177.5.40/443 (10.177.5.40/443)
6|Aug 12 2013|11:59:29|302013|10.177.5.80|50664|10.177.5.40|443|Built inbound TCP connection 2282 for outside:10.177.5.80/50664 (10.177.5.80/50664) to identity:10.177.5.40/443 (10.177.5.40/443)

`

  • If someone has provided an answer that resolves your question, please consider marking it as the accepted answer. This will reward both the person who provided the answer and yourself with additional reputation. If you do not do so, your question will periodically get refreshed back to the main page, possibly distracting community members from other questions they may be able to help answer for other users. Thank you. – YLearn Nov 5 '15 at 5:44
2

The issue was bad switch port/cable.

Even though the ping indicated 2% loss over 1000 pings there were enouph to create the issue.

| improve this answer | |
  • 4
    Yes, 2% loss is actually a LOT of loss – Ron Trunk Jan 10 '14 at 18:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.