Anyconnect VPN issues

It seems I anyconnect working to some extent.  After that I made the connection to our network with Anyconnect, she will not allow the mapped drives already back to work.

Exactly, what Miss me in the settings?

How is the drive mapped? Through the ip address or the name? You have configured for your group anyconnect policy dns or wins? Can you ping the server (by name/IP)?

You are able to access the other servers in the same subnet as the file server?

Tags: Cisco Security

Similar Questions

  • Anyconnect VPN migration issues

    Hi, I do Anyconnect VPN from an ASA ASA migration another. I need your suggestion. Migration must transfer customization and anyconnect vpn configuration. After that I reviewed some documents, looks like the configuration and customization are not the only thing that needs to be transferred. Everything can give some suggestion exactly what needs to be transferred in addition to customization and configuration vpn? Thank you

    Hello

    Although the copy of the configuration of one firewall to another will get all the anyconnect rules and the installation program completed, but the flash content (IE anyconnect programs, profiles anyconnect, customizations anyconnect, bookmarks, and dap profiles) is not transferred to the other ASA. They must be downloaded manually to the ASA again.

    Another way to do this is through ASDM,

    Go to tools > configuration backup:

    Select the components of the VPN you want to create a backup for.

    NOTE *.
    This backup will be restored as a whole via ASDM and substitute another configuration.
    So, you might want to restore the backup to a fresh firewall and then import the configuration and the images of the SAA.

    Otherwise, you can go the ususal path, the anyconnect first configuration copy and then manually transfer components anyconnect flash of one ASA to another.

    **********

    Kind regards
    Dinesh Moudgil

    PS Please rate helpful messages.

  • Cisco asa anyconnect vpn client mode issue

    Hi team,

    I get my users anyconnect vpn connection failures very frequently and it that comesup.

    Can you please check see the version attached and explain, if I run with licenses right into place.

    concerning

    SecIT

    Hello

    You've got license for 250 users anyconnect so unless you are having more users than this number, it shouldn't be a problem. Debugs could help reduce the problem in this case.

    Kind regards
    Dinesh Moudgil

    PS Please rate helpful messages.

  • AnyConnect VPN client authentication using certificates

    Guys, I'm trying to configure my ASA5505 to authenticate the AnyConnect VPN clients using certificates. I have 'Certificates' defined as my method of authentication in my AnyConnect connection profile (see screenshot), but I get 'Certificate Validation failure' whenever I try to connect. The certificate I want to use is a computer issued by my CA certificate company root (Windows Server 2008 running Active Directory Certificate Services). Screenshot of certificate is attached. I added the root certificate on the SAA, and I tried all kinds of combinations by using the corresponding certificate in the AnyConnect Client profile. Each attempt failed, and I'm having no luck finding documentation on how to proceed. Any help would be greatly appreciated!

    Hello Shaun,

    The problem you're describing, not be able to authenticate through certificate through Microsoft Internet Explorer, is the fact that the certificate is in the computer store.  You do not want to confirm with Microsoft, but, I understand that only Microsoft Internet users explore the user store, this certificate is not available to attend the ASA via the Internet browser.

    -Craig

  • Cisco Cert Anyconnect VPN

    All the

    What is the advantage of purchasing a Cert compared to create our own?

    What is the process for buying a Cisco Cert for court Anyconnect VPN?

    A certificate issued by a well-known root certification authority will be automatically approved by most of the clients, which means they can't click past warnings / download your local certificate manually during the connection. Cisco does not sell certificates that they do not work a certification authority root in public. Any number of providers offer this service well (Entrust, GoDaddy, Verisign, Thawte etc.).

    Create your own requires a bit more expertise configuration and involves usually have your customers that is always click past warnings or manually install your local signed certificate in their trusted certificate store - generally regarded as binding by most end-users and inspiring potentially much more than calls from your home office or help of TI.

  • AnyConnect VPN Microsoft CA and a Public certificate

    Hello

    I'm looking for some help with a script. I'm no expert in networks by any stretch and I won't implement myself but I need to try to understand if it is possible what I'm looking for.

    We are implementing an Anyconnect VPN with certificate of our own internal CA of Microsoft authentication. I have a product which will distribute certificates from a model for mobile devices rather than the SAA itself. We have our CA and a certificate of identity on the SAA and the operation of the authentication.

    However, the IOS Anyconnect application complains that no reliable VPN.

    So from there, I get that I need a public certificate on the SAA, but can I still have the certificate of the Microsoft CA and certificate of identity making the authentication of end users?

    Can I have written some of it wrong, but I think this gives an idea where I'm going.

    Pointers would be greatly appreciated.

    Yes - IOS is somewhat capricious won't trust internal CA issued certificates. You can buy and install a certificate from a well known public certification authority and to identify your ASA. That will be the certificate bound to the ASA outside interface and it will allow the customers based on IOS (and all others) to connect using this certificate.

    This part is distinguished by the device or user certificates on clients. Those who can still be used, as long the ASA has imported the Microsoft CA on trusts and the public key of the server, the two can co-exist.

  • Setup for use with Cisco Anyconnect VPN IPsec

    So, I had trouble setting up VPN on our ASA 5510. I would use IPsec VPN so that we don't have to worry about licensing issues, but what I have read you can do with and always use Cisco Anyconnect. My knowledge on how to set up VPN especially in iOS version 8.4 is limited, so I've been using a combination of command line and ASDM.

    I am finally able to connect from a remote location, but once I log in, nothing else works. What I've read, you can use IPsec for client-to-lan connections. I use a pre-shared for this. Documentation is limited on what should happen after have connected you? Shouldn't be able to local access on the vpn connection computers? I'm trying to implement work. If I have VPN from home, should not be able to access all of the resources at work? According to me, because I used the command-line as ASDM I confused some of the configuration. In addition, I think that some of the default policies are confused me too. So I probably need a lot of help. Here is my current setup with the changed IP address and other things that are not related to deleted VPN.

    NOTE: We are still testing this ASA and is not in production.

    Any help you can give me is greatly appreciated.

    ASA Version 8.4 (2)

    !

    ASA host name

    domain.com domain name

    !

    interface Ethernet0/0

    nameif inside

    security-level 100

    the IP 192.168.0.1 255.255.255.0

    !

    interface Ethernet0/1

    nameif outside

    security-level 0

    IP 50.1.1.225 255.255.255.0

    !

    interface Ethernet0/2

    Shutdown

    No nameif

    no level of security

    no ip address

    !

    interface Ethernet0/3

    Shutdown

    No nameif

    no level of security

    no ip address

    !

    interface Management0/0

    No nameif

    security-level 100

    IP 192.168.1.1 255.255.255.0

    !

    boot system Disk0: / asa842 - k8.bin

    passive FTP mode

    DNS domain-lookup outside

    DNS server-group DefaultDNS

    !

    permit same-security-traffic intra-interface

    !

    network of the NETWORK_OBJ_192.168.0.224_27 object

    subnet 192.168.0.224 255.255.255.224

    !

    object-group service VPN

    ESP service object

    the purpose of the tcp destination eq ssh service

    the purpose of the tcp destination eq https service

    the purpose of the service udp destination eq 443

    the destination eq isakmp udp service object

    !

    allowed IP extended ip access list a whole

    !

    mask 192.168.0.225 - 192.168.0.250 255.255.255.0 IP local pool VPNPool

    no failover

    failover time-out period - 1

    ICMP unreachable rate-limit 1 burst-size 1

    ASDM image disk0: / asdm - 645.bin

    don't allow no asdm history

    ARP timeout 14400

    NAT (inside, outside) static source any any static destination NETWORK_OBJ_192.168.0.224_27 NETWORK_OBJ_192.168.0.224_27 non-proxy-arp-search to itinerary

    !

    the object of the LAN network

    NAT dynamic interface (indoor, outdoor)

    Access-group outside_in in external interface

    Route outside 0.0.0.0 0.0.0.0 50.1.1.250 1

    Sysopt noproxyarp inside

    Sysopt noproxyarp outdoors

    Crypto ipsec transform-set ikev1 SHA-ESP-3DES esp-3des esp-sha-hmac

    Crypto ipsec transform-set ikev1 ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

    Crypto ipsec transform-set ikev1 ESP-DES-SHA esp - esp-sha-hmac

    Crypto ipsec transform-set ikev1 esp ESP-DES-MD5-esp-md5-hmac

    Crypto ipsec transform-set ikev1 ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

    Crypto ipsec transform-set ikev1 ESP-3DES-MD5-esp-3des esp-md5-hmac

    Crypto ipsec transform-set ikev1 ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

    Crypto ipsec transform-set ikev1 ESP-AES-128-SHA aes - esp esp-sha-hmac

    Crypto ipsec transform-set ikev1 ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

    Crypto ipsec transform-set ikev1 ESP-AES-128-MD5-esp - aes esp-md5-hmac

    Crypto ipsec ikev2 ipsec-proposal OF

    encryption protocol esp

    Esp integrity sha - 1, md5 Protocol

    Crypto ipsec ikev2 proposal ipsec 3DES

    Esp 3des encryption protocol

    Esp integrity sha - 1, md5 Protocol

    Crypto ipsec ikev2 ipsec-proposal AES

    Esp aes encryption protocol

    Esp integrity sha - 1, md5 Protocol

    Crypto ipsec ikev2 ipsec-proposal AES192

    Protocol esp encryption aes-192

    Esp integrity sha - 1, md5 Protocol

    Crypto ipsec ikev2 AES256 ipsec-proposal

    Protocol esp encryption aes-256

    Esp integrity sha - 1, md5 Protocol

    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev2 AES256 AES192 AES 3DES ipsec-proposal OF

    outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

    outside_map interface card crypto outside

    Crypto ca trustpoint ASDM_TrustPoint0

    registration auto

    name of the object CN = ASA

    Configure CRL

    crypto ca server

    Shutdown

    string encryption ca ASDM_TrustPoint0 certificates

    certificate d2c18c4e

    864886f7 0d06092a c18c4e30 308201f3 3082015c a0030201 d 020204 2 0d 010105

    0500303e 3110300e 06035504 03130741 53413535 3130312a 2 a 864886 30280609

    02161b 41 53413535 31302e64 69676974 616c 6578 7472656d 65732e63 f70d0109

    3131 31303036 31393133 31365a 17 323131 30303331 39313331 0d 170d 6f6d301e

    365a303e 3110300e 06035504 03130741 53413535 3130312a 2 a 864886 30280609

    02161b 41 53413535 31302e64 69676974 616c 6578 7472656d 65732e63 f70d0109

    6f6d3081 9f300d06 092 has 8648 86f70d01 01010500 03818d b 30818902-00-818100-2

    8acbe1f4 5aa19dc5 d3379bf0 f0e1177d 79b2b7cf cc6b4623 d1d97d4c 53c9643b

    37f32caf b13b5205 d24457f2 b5d674cb 399f86d0 e6c3335f 031d54f4 d6ca246c

    234b32b2 b3ad2bf6 e3f824c0 95bada06 f5173ad2 329c28f8 20daaccf 04c 51782

    3ca319d0 d5d415ca 36a9eaff f9a7cf9c f7d5e6cc 5f7a3412 98e71de8 37150f02

    03010001 300 d 0609 2a 864886 f70d0101 05050003 8181009d d2d4228d 381112a 1

    cfd05ec1 0f51a828 0748172e 3ff7b480 26c197f5 fd07dd49 01cd9db6 9152c4dc

    18d0f452 50f5d0f5 4a8279c4 4c1505f9 f5e691cc 59173dd1 7b86de4f 4e804ac6

    beb342d1 f2db1d1f 878bb086 981536cf f4094dbf 36c5371f e1a0db0a 75685bef

    af72e31f a1c4a892 d0acc618 888b53d1 9b 888669 70e398

    quit smoking

    IKEv2 crypto policy 1

    aes-256 encryption

    integrity sha

    Group 2 of 5

    FRP sha

    second life 86400

    IKEv2 crypto policy 10

    aes-192 encryption

    integrity sha

    Group 2 of 5

    FRP sha

    second life 86400

    IKEv2 crypto policy 20

    aes encryption

    integrity sha

    Group 2 of 5

    FRP sha

    second life 86400

    IKEv2 crypto policy 30

    3des encryption

    integrity sha

    Group 2 of 5

    FRP sha

    second life 86400

    IKEv2 crypto policy 40

    the Encryption

    integrity sha

    Group 2 of 5

    FRP sha

    second life 86400

    Crypto ikev2 activate out of service the customer port 443

    Crypto ikev2 access remote trustpoint ASDM_TrustPoint0

    Crypto ikev1 allow outside

    IKEv1 crypto policy 10

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    IKEv1 crypto policy 65535

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    Telnet timeout 5

    SSH timeout 10

    Console timeout 0

    management-access inside

    SSL-trust outside ASDM_TrustPoint0 point

    WebVPN

    allow outside

    AnyConnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1

    AnyConnect image disk0:/anyconnect-linux-2.5.2014-k9.pkg 2

    AnyConnect image disk0:/anyconnect-macosx-i386-2.5.2014-k9.pkg 3

    profiles of AnyConnect VPN disk0: / devpn.xml

    AnyConnect enable

    tunnel-group-list activate

    internal VPN group policy

    attributes of VPN group policy

    value of server WINS 50.1.1.17 50.1.1.18

    value of 50.1.1.17 DNS server 50.1.1.18

    Ikev1 VPN-tunnel-Protocol, l2tp ipsec ikev2 ssl-client

    digitalextremes.com value by default-field

    WebVPN

    value of AnyConnect VPN type user profiles

    always-on-vpn-profile setting

    privilege of xxxxxxxxx encrypted password username administrator 15

    VPN1 xxxxxxxxx encrypted password username

    VPN Tunnel-group type remote access

    General-attributes of VPN Tunnel-group

    address (inside) VPNPool pool

    address pool VPNPool

    LOCAL authority-server-group

    Group Policy - by default-VPN

    VPN Tunnel-group webvpn-attributes

    enable VPN group-alias

    Group-tunnel VPN ipsec-attributes

    IKEv1 pre-shared-key *.

    !

    class-map inspection_default

    match default-inspection-traffic

    class-map ips

    corresponds to the IP access list

    !

    !

    type of policy-card inspect dns preset_dns_map

    parameters

    maximum message length automatic of customer

    message-length maximum 512

    Policy-map global_policy

    class inspection_default

    inspect the preset_dns_map dns

    inspect the ftp

    inspect h323 h225

    inspect the h323 ras

    Review the ip options

    inspect the netbios

    inspect the rsh

    inspect the rtsp

    inspect the skinny

    inspect esmtp

    inspect sqlnet

    inspect sunrpc

    inspect the tftp

    inspect the sip

    inspect xdmcp

    inspect the http

    class ips

    IPS inline help

    class class by default

    Statistical accounting of user

    I would recommend buy AnyConnect Essentials. The cost of the license is nominal - list of US $150 for the 5510. (piece number L-ASA-AC-E-5510 =)

    Meawwhile you can use the Cisco VPN client inherited with IKEv1 IPSec remote access VPN using profiles *.pcf.

    I believe you can also use the client Anyconnect client SSL or DTLS transport access remotely (non-IPsec) without having to buy the license Anyconnect Essentials for your ASA focus.

    As an aside, note that if you want to use AnyConnect Mobile (e.g. for iPhone, iPad, Android, Blackberry etc.clients) you will also get the additional license for it (L-ASA-AC-M-5510 =, also price US $150)

  • Quality of VoIP BOUNCING over AnyConnect VPN problems

    Hello:

    I'm in the middle of the conversion of our environment of VPN for remote access of the former client VPN Cisco AnyConnect (ver. 3.1.01065) VPN's IPSec. I have a number of beta-testers on the new AnyConnect VPN environment, and we have quality problems of intermittent VoIP (IP Communicator 8.5.3 on remote laptops) with the HQ VPN. While I realize that we miss the calls over the Internet, which is a network of 'better' and can not control the Inernet QoS, the special thing is the VoIP call on the former that ipsec VPN seems to work very well 99% of the time.

    I did a series of G.729 calls on the old client IPSec and customer AC, with the same laptop, using the same remote access connection. The "VPN server" for the IPSec VPN is an ASA5520 (8.0 (4)), on a connection of 100 Mbps with plenty of reserve, which runs also firewall services for an office of about 500 people and a small DMZ environment. The VPN server that is handling AnyConnect VPN is a new ASA5515-X (8.6 (1) 2), using the same channel of 100 Mbit/s Internet and running VPN services only. When you call running of tests on the old IPSec VPN, the jitter of appeal is pretty consistent, where jitter ave runs about 10 ms and jitter peak running 30-40ms. On the client ACTS, so that 'good' calls run about the same jitter as the old VPN, called the 'bad' (drops intermittent speaker, sometimes sounds 'mechanized'), which produce about 1 of evey 5 calls, run jitter ave to about 120-150ms and jitter of tip of 300-400 m for info, I don't see no packet loss to talk, just call jitter is through the roof. While in most cases, this could be written off as a "bad Internet connection", on the pretty old VPN tests prove a lot is not the issue.

    That said, anyone has an idea why the quality of calls is sometimes wrong via the AnyConnect VPN? Is there pest practices that I can work from, or any settings you can recommend? Thank you.

    Well, there are several things in our implementation that could help if possible, although I think you can open the case of the TAC, we saw some strange behaviors.

    Things to enable the audit side ASA/SSL:

    -DTLS - check if it is enabled and WORK (see the det filter name NAME_HERE anyconnect vpn-sessiondb)

    see if the packets are tunneled by the DTLS Protocol not TLS. The datagram transport is much better suited for performance.

    -Compression - so we see a lot of deployments with it enabled us say this as much as we can. Compression is for links to bandwidth low latency. In the modern internet, it should be used with caution.

    -check the ASP drop table on ASA (fall of claire asp, run the "show asp drop' rest and during the period of low performance monitor.)

    -additional recording "class... ssl connection. "can give you greater participation.

    -See the proto ssl_np - good starting point count

    the list goes on and.

    What is important to understand, is that the problem is with the traffic on the wire or from the use of SSL.

    Sniffer traces are essential.

    M.

  • Phones AnyConnect VPN cannot connect to network ASA high-speed AT & T uverse

    Phones AnyConnect VPN are configured to connect to the ASA 5510 running 8.4 (4), and it uses the Active Directory credentials to connect. The connection is successful external ISP systems including Comcast and smaller independent service providers. However, when all of us at the AT & T uverse service take this phone 7965 even at home it networks fails to make any connection to the ASA at all. A capture of packets on the ASA shows no activity connection to the IP address of our uverse.

    What's more, is that we can successfully authenticate the VPN of the phone when using the local account credentials (e.g. username admin password * priv 15) that are entered on the SAA. AT & T said that they are not blocking the ports. It is the confusion that this works for users to access local connection, but not with A/D.

    So I guess the question is: what is the first handshake TCP/UDP composed when a Cisco IP phone links AnyConnect SSL to an ASA and negotiates the authentication of the number of A/D? For example, what are the port numbers used in this handshake?  I couldn't find all the diagrams illustrating the HRT and the RFC for DTLS do not seem to have the answer either.

    Thanks in advance.

    -Athonia

    Note: we have a TAC case open currently with subject ASA 5510 VPN Edition w / 250 annyconnect user - SSL VPN for phones. Configuration

    I too ran on this issue and here is a description of what I found.

    If you use automatic network detection first trys phone ping the TFTP server, he has learned from the DHCP server or manually set with the parameter of the alternate TFTP server.  If the TFTP server is accessible the VPN will not connect and will not allow the user to connect manually.

    ATT Uverse use DHCP option 150, the same option as Cisco UC uses to automatically set the TFTP servers, to locate the local home gateway so that the STB can join him.  For this reason, you should notice that when you have a VPN phone on the network and view network settings the IP address of the TFTP server is the IP address of your default gatewat (The ATT router).

    Because of the automatic detection of network works in ping the TFTP server that the phone will always think that it is connected to the local network.  The workaround is to manually set the TFTP server on the phone * to the IP address that the TFTP server would have been if she had leared it from the DHCP server on your corporate network.  The reason you should do this instead of just using a Bogon address, is that once the VPN is connected it tryes to register to the address that you specified.

    Please let me know if this solves your problem as it did in our case.

    * If you do not know how to set the TFTP replacement setting you must first select the "replacement" TFTP protocol and press on * #.  This will allow you to change the default no to Yes.  The below named parameter TFTP Server 1 will then allow you to manually specify the address.

  • AnyConnect VPN and HP Office Jet Pro 8500 A910

    I can print from my laptop IBM T400 running Windows 7 64 bit. However, when I log in work AnyConnect VPN, I can't print. He says that the printer is disconnected from the network, even if it is connected. IT support at work said he can't change or adjust the VPN settings. The only way I can print is to disconnect from the VPN. Is this what I can adjust on the software of the printer or the printer itself?

    Hello

    To be able to print on the local network when you are connected to a network remote VPN might be possible by changing the VPN split tunneling configuration.

    However, it is depands on the VPN features and cannot be authorized because of the security requirements of your IT Department.

    Anyway, there is no way to configure such a thing by the printer or the printer software... It is directly affected by the configuration of the network and therefore require to modify VPN settings.

    Kind regards

    Shlomi

  • Cisco AnyConnect VPN Client maintains reconnection

    Hello

    We have recently installed an ASA5505 and activated the VPN access.

    Two of my colleagues have no problems connecting to the VPN using Cisco AnyConnect VPN Client, but I do.

    I am still disconnected after a few seconds with the message:

    "A VPN reconnect gave rise to different configuration settings. VPN network interface is to be reset. Applications using the private network may be required to restart. »

    Cisco AnyConnect VPN Client Version 2.5.2019

    I work with Windows 7 but the same thing happens when I try to connect using my computer that is running Windows Vista.

    My colleagues also using Win7

    I also tried to disable the Windows Firewall.

    Any help would be appreciated.

    Best regards

    Peter

    TAC has been able to solve the problem.   For webvpn mtu changed default from 1406 to 1200.

    Not sure why 2 other ASAs we work very well otherwise though!

    WebVPN
    SVC mtu 1200

  • IOS anyconnect vpn group lock and user restrictions

    Dear Experts,

    I now have two questions about cisco IOS vpn on ISR G2:

    1 is it possible to lock user group in IOS anyconnect VPN we can do in ASA? If so, can someone share the steps for her?

    2 - a customer wishes to restrict the anyconnect user login as it might turn the connection to the user on request. That is to say whenever the user wants to connect via vpn to ask the administrator to allow connection. can we do without deleting the username and create again?

    the other may be on ASA or IOS.

    Please see this guide:

    http://www.Cisco.com/c/en/us/support/docs/security/iOS-easy-VPN/117634-c...

    As he points out, "for the Cisco IOS group-lock and the ipsec: use vpn-group, it only works for IPSec (the easy VPN server)." In order to group-lock specific users in specific contexts of WebVPN (and strategies Group attached), authentication domains should be used. »

    If you lock a user to a policy that authenticates, but does provide real access permissions (say an ACL that blocks all traffic to the private network) then you have essentially made their ability to non-functional connection.

    If you use an external AAA server (for example, RADIUS or LDAP), then you can move in and out of the group which is authorized without disable VPN access / delete their account altogether.

  • CISCO ANYCONNECT VPN CISCO VPN CLIENT

    Hi, I was in the process of configuring cisco anyconnect vpn for ip phones to our local obtained the license for them either, the question that I get is that I already have remote configured cisco connect via the old cisco vpn client.

    now, if I activate the anyconnect ssl on the same outside the interface both can exist without conflict or maybe I need to migrate users to install the end customer for anyconnect system software to connect.

    I also need help with authentication of certification.

    concerning

    You can run both VPN at the same time without problems.

    However, you should try and migrate everyone to the latest technology Anyconnect SSL anyway.

  • AnyConnect VPN

    Hello

    I have configured AnyConnect VPN with split tunneling, so my internal networks is in the tunnel and get internet directly (not via an internal network).

    But we want to access one of the public IP (8.8.8.8) through AnyConnect VPN tunnel.

    When we check the capture of packets on an external interface, trying to ping 8.8.8.8 showing the icmp-request package but not get icmp-response packages.

    Additional configuration required to access the ip address above by tunnel?

    We have activated the below configuration as well.

    permit same-security-traffic intra-interface

    permit same-security-traffic inter-interface

    Please find details of the capture below: 192.168.18.71 is my ip from the pool AnyConnect VPN system.

    114 extended access-list allow ip host 192.168.18.71 8.8.8.8
    115 extended access-list allow host 8.8.8.8 ip 192.168.18.71

    output interface of capture within the list of access-114
    Capture interface entering inside the access-list 115

    See the capture of xxx - ASA (config) # outgoing

    1: 22:13:24.001800 192.168.18.71 > 8.8.8.8: icmp: echo request
    2: 22:13:28.986139 192.168.18.71 > 8.8.8.8: icmp: echo request
    3: 22:13:33.970561 192.168.18.71 > 8.8.8.8: icmp: echo request
    4: 22:13:38.971156 192.168.18.71 > 8.8.8.8: icmp: echo request
    5: 22:13:44.080058 192.168.18.71 > 8.8.8.8: icmp: echo request
    5 packs shown
    XXX - ASA (config) #.
    XXX - ASA (config) #.
    XXX - ASA (config) # display incoming capture

    0 packets captured

    0 illustrated package
    XXX - ASA (config) # display incoming capture

    0 packets captured

    0 illustrated package

    Kindly help us solve the problem.

    Thank you and best regards,

    Ashok

    I like to use the notation NAT object instead.  So maybe try:

    object network obj-192.168.18.0  nat (outside,outside) dynamic interface
  • Cisco AnyConnect VPN Client (connection attempt failed because the network or pc problem cisco)

    Hi all

    I am trying to connect to my Cisco AnyConnect VPN Client but everytime I try, I get an error (connection attempt failed because the network or pc problem cisco)

    Can anyone help me please with this.

    Thank you

    Zia

    What is the local firewall on your computer?

Maybe you are looking for