A VPN traffic fall

We are setting up a asa 5505 with anyconnect. But vpn-pool local traffic network is to be droppped. but the traffic from the inside network to the vpn client is not being deleted. Any help

Hi [email protected] / * /.

Can you also clear line 'access-group anyconnect in external interface' bur leave a vpn-filter configuration?

You can also add a line to deny a whole at the end of each ACL to see which blocks the traffic.

Best regards.

Tags: Cisco Security

Similar Questions

  • Site-to-Site VPN IPSEC falls intermittently

    Site-to-Site VPN IPSEC falls intermittently

    I am currently having a problem with a VPN from Site to Site traffic not only not intermittently. When the problem occurs, I can't Ping the remote site to the AC Site. But I can solve the problem by Pinging from HQ at the Remote Site. My network is currently configured as follows


    7.0 (4) version of pix 515 with card Ethernet 4 ports.

    Outside of the interface connected to the Broadband DSL link.

    Outside2 Interface connected to the second link DSL broadband


    I have 4 Remote Sites. 2 sites connect you to each connection to wide band at HQ to spread the load to HQ

    6.3 (5) pix 501 version

    # The problem #.

    All VPN establishes successfully to the HQ Pix

    Intermittently, a remote site will report that they cannot connect to servers/services in the HQ. When I do a show crypto ipsec's and see the crypto isakmp his headquarters there is no entry for the remote site. However when I do the same on the remote site there is an entry for the HQ. With debugging on the remote site pix I try to ping from a pc to the HQ server and I get the following (see below). If I do a "ipsec Isakmp security association claire crypto ' and ' clear crypto ipsec his ' on the pix of remote site, then I can successfully ping all servers in headquarters.

    This problem seems to have taken place only when I upgraded the pix of a 501 to 515 and added another 2 remote sites and a second broadband, as described above. I'm afraid that there is a problem with software version 7 Pix. Any advice would be greatly appreciated.

    Console record Carrick-PIX01 (config) # 7

    Carrick-PIX01 (config) # ter Lun

    Output Carrick-PIX01 (config) #.

    Carrick-PIX01 # debug crypto ipsec

    Carrick-PIX01 # debug crypto isakmp

    Carrick-PIX01 #.

    ISAKMP (0:0): sending of NAT - T vendor ID - rev 2 & 3

    ISAKMP (0): early changes of Main Mode

    ISAKMP (0): retransmission of the phase 1 (0)...

    ISAKMP (0): retransmission of the phase 1 (1)...

    ISAKMP (0): retransmission of the phase 1 (2)...

    Carrick-PIX01 #.

    Carrick-PIX01 #.

    ISAKMP (0): retransmission of the phase 1 (3)...

    Carrick-PIX01 #.

    Carrick-PIX01 #.

    ISAKMP (0): retransmission of the phase 1 (4)... IPSec (key_engine): request timer shot: count = 1,.

    (identity) local = OUTER-IP, distance =,.

    local_proxy = LAN-OFFICE/ (type = 4),

    remote_proxy = 194.x.x.x.x.255.0/0/0 (type = 4)

    ISAKMP (0): delete SA: CBC EXTERNAL IP, dst

    ISADB: Reaper checking HIS 0x10c167c, id_conn = 0 DELETE IT!

    Peer VPN: ISAKMP: Peer Info for not found - peer: 1

    ISADB: Reaper checking HIS 0x10ca914, id_conn = 0

    Can force you the ISAKMP Keepalive, value from IPSec Security Association idle time and on the other. The problem should be solved

    ISAKMP crypto keepalive 30

    Crypto ipsec security association temps_inactivite 60

    Let me know if it helps

  • Configuration of the router to allow VPN traffic through

    I would like to ask for assistance with a specific configuration to allow VPN traffic through a router from 1721.

    The network configuration is the following:

    Internet - Cisco 1721 - Cisco PIX 506th - LAN

    Remote clients connect from the internet by using the Cisco VPN client. The 1721 should just pass the packets through to the PIX, which is Inside of the interface of the router is

    The pix was originally configured with a public ip address and has been tested to work well to authenticate VPN connections and passing traffic in the local network. Then, the external ip address was changed to and the router behind.

    The 1721 is configured with an ADSL connection, with fall-over automatic for an asynchronous connection. This configuration does not work well, and in the local network, users have normal internet access. I added lists of access for udp, esp and the traffic of the ahp.

    Cisco VPN clients receive an error indicating that the remote control is not responding.

    I have attached the router for reference, and any help would be greatly apreciated.



    For VPN clients reach the PIX to complete their VPN the PIX needs to an address that is accessible from the outside where the customers are. When the PIX was a public address was obviously easy for guests to reach the PIX. When you give the PIX one address private, then he must make a translation. And this becomes a problem if the translation is dynamic.

    You have provided a static translation that is what is needed. But you have restricted the TCP 3389. I don't know why you restricted it in this way. What is supposed to happen for ISAKMP and ESP, AHP traffic? How is it to be translated?

    If there is not a static translation for ISAKMP traffic, ESP and AHP so clients don't know how to reach the server. Which brings me to the question of what the address is configured in the client to the server?



  • 7.2 ASA5520 - filters VPN traffic

    Hi all,

    I would like to know how can I filter out VPN traffic with a list of access, by using the source address and port of destination as filters.

    I tried with "no sysopt permit vpn connection" but it is to filter the traffic through the VPN tunnel and I want to filter the host which can establish the VPN tunnel.

    I did it in a router with this access list:

    Note access-list 101 VPN

    access-list 101 permit ahp host x.x.x.x everything

    access-list 101 permit esp host x.x.x.x any newspaper

    access-list 101 permit host x.x.x.x esp all

    access-list 101 permit udp host x.x.x.x any eq isakmp

    access-list 101 permit udp host x.x.x.x any eq non500-isakmp

    But I tried the same thing in the ASA and does not work, I think it's because the ASA does not apply the access list for VPN traffic.

    Sincerely, Fernando.


    You can disable it with "no crypto isakmp are outside", but then even if you apply an acl to the outside which allows all IP, ESP, AH it still does not allow an IPSEC connection.

    So for the moment I see no way to do this without using an acl on your router upstream.

    I'll do a reading just in case I missed something.


  • Capture packets for VPN traffic

    Hi team,

    Please help me to set the ACL and capture for remote access VPN traffic.

    To see the amount of traffic flows from this IP Source address.

    Source: Remote VPN IP (syringe) access

    Destination: any

    That's what I've done does not

    extended VPN permit tcp host access list all

    interface captures CAP_VPN VPN access to OUTSIDE gross-list data type


    If you have configured capture with this access list, you filter all TCP traffic, so you will not be able to see the UDP or ICMP traffic too, I would recommend using the ACL, although only with intellectual property:

    list of allowed extended VPN ip host access everything

    Capture interface outside access, VPN CAP_VPN-list

    Then with:

    See the capture of CAP_VPN

    You will be able to see the packet capture on the SAA, you can export the capture of a sniffer of packages as follows:

      https:// /capture//pcap capname--> CAP

    For more details of capture you can find it on this link

    Let me know if you could get the information that you were trying to achieve.

    Please Don t forget to rate and score as correct the helpful post!

    David Castro,

    Kind regards

  • NAT on the VPN traffic

    Hello everyone, I need help in a vpn configuration, this is the problem that I need nat all vpn traffic because I net to put into place a vpn but I already have another vpn with the same network, so that overlap with the new one, then how I can nat overlaps all traffic to another network in order to avoid the network?.

    Please I really need help

    Thank you

    You say that the is able to go through the tunnel and the internet now?

    Try to add another...

    IP nat inside source static map route VPN

    for example.


  • ASA encrypt interesting VPN traffic

    Hello everybody out there using ASA.

    I had a few IPSEC VPN tunnels between the company's central site and remote sites.

    Two dsl lines were connected to the ASA, one for VPN traffic and the other for the internet.

    The default gateway has been configured online internet, some static while insured roads as traffic to the sites of the company was sent through the other line.

    A few days ago we changed the configuration of ASA to use only a single dsl connection, then the line serving the internet has been cut, while the other will become the gateway default and static routes have been removed.

    The VPN connections instant stopped working and trying to send packets to the remote lan, it seems that ASA will not recognize that the traffic is encrypted. Obviousely we checked cryptomap, acl, ecc, but we find no problem... do you have any suggestions?

    Thanks in advance,



    XNetwork object network subnet

    network of the YNetwork object subnet

    card crypto RB1ITSHDSL001_map2 1 corresponds to the address RB1ITSHDSL001_1_cryptomap
    card crypto RB1ITSHDSL001_map2 1 set peer a.b.c.186
    RB1ITSHDSL001_map2 1 transform-set ESP-3DES-SHA crypto card game

    RB1ITSHDSL001_1_cryptomap list extended access permitted ip XNetwork object YNetwork



    Your exit the ASA must be encrypting the traffic between XNetwork and YNetwork.

    If the ASA does not encrypt this traffic, it could be because there is a problem with the NAT configuration.

    When the ASA receives a packet, it must first check if there are ACLs that allows traffic, passes through the inspection engine and check that the associated NAT. For example, if the package is coordinated, then the private IP encryption will never take place.

    Could ensure you that packets from the XNetwork are really reach the ASA, the NAT rule is correct and you may be looking for "debugging cry isa 127" and "scream ips 127" debug to check for errors of incompatibility.

    In addition, what is the condition of the tunnel trying to communicate: "sh cry isa his"


  • VPN needs access to all external internal vpn traffic traffic all in tunnel


    Could someone help me find the problem?

    I am ASA configuration as firewall + vpn server, essentially outside of the device's access T1 (there are two VLANS in inside via an iptables, outside of iptables is on the same vlan as insdie of ASA ( and  VPN users are authenticated via authentication 2 factors (SDI, ip is and get the ACL by local database.  pool of VPN is - pool of VPN is coordinated to the external IP address

    trying to access a remote host A from the host a is open for the IP and one specific Protocol. all vpn traffic are in the tunnel. the VPN user can connected and ACL vpnuser1_ONLY not working does not as expected.

    Here is the part of configuration:

    ASA Version 8.2 (2)

    Route outside xx.10.194.193 1

    Route inside companynet1 1

    Route inside companynet2 1

    Route inside companynet3 1

    Route inside companynet4 1


    Route inside companynetn 1

    NAT (inside) 4 vpnpool outside   <--------- is="" this="">

    Global (outside) 4 xx.10.194.238 netmask

    Split-tunnel-policy tunnelall


    vpnuser1_ONLY list extended access permitted tcp vpnpool host eq ssh connect

    vpnuser1_ONLY list extended access permitted tcp vpnpool host eq ssh connect


    enable SVC

    tunnel-group-list activate

    attributes of Group Policy DfltGrpPolicy

    VPN - connections 8

    VPN-idle-timeout 10

    VPN-session-timeout 60

    Protocol-tunnel-VPN l2tp ipsec


    SVC Dungeon - install any

    time to generate a new key of SVC 8

    SVC generate a new method ssl key

    SVC request no svc default

    internal GroupPolicy1 group strategy

    attributes of Group Policy GroupPolicy1

    VPN - connections 1

    VPN-idle-timeout 9

    VPN-session-timeout 45

    VPN-tunnel-Protocol svc

    Split-tunnel-policy tunnelall


    SVC Dungeon - install any

    time to generate a new key of SVC 15

    SVC generate a new method ssl key

    client of dpd-interval SVC 30

    dpd-interval SVC 30 bridge

    value of deny message connection succeeded, but because some criteria have not been met, or because of a specific group policy, you are not allowed to use the VPN features. For more information, contact your COMPUTER administrator.

    disable the SVC routing-filtering-ignore

    username vpnuser1 encrypted password xxxxxxx

    username vpnuser1 attributes

    VPN-group-policy GroupPolicy1

    VPN-idle-timeout 6

    VPN-session-timeout 20

    VPN-filter value vpnuser1_ONLY

    VPN-tunnel-Protocol svc

    value of group-lock COMAVPN

    type of remote access service

    tunnel-group DefaultRAGroup webvpn-attributes

    Disable group companyvpn aliases

    type tunnel-group COMAVPN remote access

    attributes global-tunnel-group COMAVPN

    address (inside) vpnpool pool

    address vpnpool pool

    SDI Group-authentication server

    authentication-server-group (inside) SDI

    LOCAL authority-server-group

    Group Policy - by default-GroupPolicy1

    tunnel-group COMAVPN webvpn-attributes

    activation of the Group companyremote alias

    I did anything wrong / missing?

    Thank you


    First of all, you can set "no nat-control" because once you have relieved of NAT, 'no nat-control' becomes disable anyway. 'No nat-control' is useful if you have no statement of NAT at all on the interface.

    Second, if you can't access the outside inside which is because you must configure the NAT exemption. Not sure if you have configured it.

    Here's the command:

    access-list allowed sheep ip

    NAT (inside) 0 access-list sheep

    You can then add all other subnets that are internal to the ACL sheep if you need VPN access.

    Finally, for the error message deny on access-group "OUTSIDE", you would need check if you have configured "sysopt connection VPN-enabled'. If it is disabled, it will also check the "OUTSIDE" interface for VPN traffic.

  • VPN traffic via a secondary access provider

    Hello world

    I have been asked by a client to implement this topology:


    ISP 1 is used as primary internet connection.

    2 ISP will be used to connect remote users by IPsec VPN.

    Currently, I'm not looking for the Active/Backup feature, I need to know if I can use both ISP connections (as I've written before) an ISP for the Internet company and the other for the user remote access VPN.

    I read some post where, said, it's possible, but I want to be sure.

    Kind regards


    ASA must add the static route in the routing table automatically when the VPN client is connected. So, in general, you don't need to do anything. But if not, you can just manually configure who will forward a VPN client IP packet to ISP2.

    With respect to NAT, in general, VPN traffic must ignore the NAT. You can use "nat (inside_interface_name) 0-list of access ' with an ACL that define the vpn traffic to do so.

  • WSA issue with MS-OUTLOOK and VPN traffic

    Hi all

    I am facing a problem where

    1. my users are able to access their mail from the web page, but ms-outlook is not able to synchronize e-mail.

    2. our internal user to an external site via VPN, the user is able to establish the VPN connection, but the web page user tries to gain access to via VPN is not available. I can see traffic from the user to WSA in the firewall, but the traffic of WSA is not forward traffic after that.

    Please suggest. As it is new, I needmore helps everyone.

    Run the command grep in WSA CLI to get the corresponding access logs to see the behavior of the ASO at demand management.

    Grep, access connects for a starter, SSH to the ASO and run the following command from the CLI:

    1 Grep
    2. Enter the number of the journal you want to grep: 1 (for accesslogs)
    3. Enter the regular expression to grep: . *.
    4. do you want the search to be case insensitive? : Y
    5. do you want to tail the logs? : Y
    6. you want to paginate output? : N

    Please keep in mind WSA is passively receiving the traffic and please ensure those kind of traffic will be sent to ASO before confirm us that it of a WSA question or not.

  • VPN traffic scanned by CSC

    Site2Ste VPN are configured at the branch offices. Traffic Internet goes through the VPN and the main office. Can the module CSC analysis this traffic?



    If the traffic is decrypted before/on the ASA, then Yes.



  • VPN-filer configuration on the VPN traffic

    Hello world

    We set up a site to ipsec with the seller.

    For security reasons we do not want to allow all traffic through the tunnel.

    ASA has 2 interfaces both inside and outside.

    We refuse any one on the external interface ip.

    I have config vpn run ACL to allow traffic on port ssh, icmp through the tunnel.

    Then I applied it under the group policy.

    name of VPN-filter value.

    Need to confirm that I must also allow ipec protocols as esp etc under VPN filter ACL?



    The vpn-filter is applied to the traffic flowing through the tunnel. You don't need to allow all traffic that 'built' like IKE and IPsec VPN.

    On the SAA, you must also add this traffic to your external ACL is it necessary on IOS routers.

    For the vpn-filter, be aware that the syntax is not

    This is relevant when you want to filter traffic from your network to the network of peers.
  • Send all VPN traffic and the other end it blocks Internet


    I wonder if I can get a RV042 VPN Tunnel to a RV082 and in the RV082 block all traffic on the internet that comes form the computers that are behind the RV042.

    Something like this:

    Remote PC-> RV042-> VPN-> RV082-> firewall RV082 (block internet traffic, allow intranet traffic)

    Thank you very much


    The scenario you describe should be doable with a pair of RV042 and RV082, where all traffic is transmitted by RV042 to RV082. What you need is to configure an access on RV082 rule to deny the RV042 subnet HTTP traffic to ALL (internet).

  • VPN traffic routed not when ATM / Dialer interface is up

    I have a 1841 router using a serial port for the T1 and a WIC ATM to ADSL. I want all traffic to the data center of my company to go out to the T1 and all other traffic out of the ADSL connection. There is a VPN connection to the data center which works fine until the ATM/Dialer interface is enabled. The VPN tunnel is created, but no traffic is routed over the VPN. I have attached the router config.


    You can try configurations and make the new test below.

    IP route datacenterLAN serial0/0/0

    IP route datacenterLAN2 serial0/0/0

    IP route datacenterLAN3 serial0/0/0

    IP route datacenterLAN Dialer1 5

    IP route datacenterLAN2 Dialer1 5

    IP route datacenterLAN3 Dialer1 5

    Kind regards


    * Please note all useful messages *.

  • Monitoring of VPN traffic

    If a user connects using the AnyConnect client, and then connects via RDP to an internal Windows machine, I'd be able to see all traffic via syslog from the RDP session?  I can see the client login, auth, DHCP, then the port 3389 in order to connect to the internal area of Windows, but only once the connection on port 3389 traffic (and subsequent termination of the VPN session at the request of the user).  It seems that there is a kind of traffic through the ASA to the VPN client, at least at the level of the presentation layer.  Asked me to look at this to determine if a person was actually connected and work or if they have just connected to make it look like they were doing their job.

    Also, in the same sense - is there a difference shown when a session ends for max of the session and a user actually disconnection?  The reason why I ask this question is the above user has been connected for exactly 12 hours, which is the Max connection time (720 minutes), but the newspaper it says was by the request of the user.  My guess is that it was a max session timeout but I have to be positive about that.

    Thanks in advance...

    If the RDP user in a device, the activity that takes place during the RDP session would be from this device to other applications. When you're talking about syslog, I guess you see syslog messages when the RDP box creates an outgoing link or other subnet that goes through the ASA and ASA sends syslog messages?

    If you want to see activity in the RDP session, you need check the outbound RDP host connection, and for the SAA trigger and send syslog, traffic from the host RDP must pass through the ASA.


    Connect to it via RDP and AnyConnect.

    If you want to check the activities, you will need to check if launches all connections.

    In regards to the max session disconnects, can you please share the syslog message which specifies that.

    Hope that helps.

Maybe you are looking for