ASA 5505 AnyConnect Client issues

Similar Questions

• Issue of Cisco ASA 5505 Anyconnect Client NAT'ing

  Hello

  We have a split_tunnel RA Vpn configuration in a branch that works very well in all areas except the destinged of traffic for a specific website using https.  This provider does not allow HTTPS connections to bring some outside IP addresses.

  Essentially, this should work like this:

  RAVPN_client (10.4.4.0/27)--> https request to the (208.x.x.x) vendor_ip---> ASA55XX--> NAT_to_outside_ip--> to the vendor_ip (208.x.x.x) https request

  I need to understand how you would approach from ONLY this https traffic specific to the RA VPN without having to change the installer otherwise.

  Internal hosts (aka behind the ASA physically) have not any question at this site, as would his nat ip address outside that we expect.

  Here is what we use for the NAT Exemption it list 10.2.2.x, 192.168.100.x, and 172.23.2.x are other remote sites we have. The 10.4.4.0/27 RA VPN users don't have no problems connecting to them, regardless of the Protocol:

  Note to inside_nat0_outbound access-list of things that should not be Nat would

  access extensive list ip 10.12.1.0 inside_nat0_outbound allow 255.255.255.0 10.2.2.0 255.255.255.0

  access extensive list ip 10.12.1.0 inside_nat0_outbound allow 255.255.255.0 192.168.100.0 255.255.255.0

  access extensive list ip 10.12.1.0 inside_nat0_outbound allow 255.255.255.0 172.23.2.0 255.255.255.0

  access extensive list ip 10.12.1.0 inside_nat0_outbound allow 255.255.255.0 10.4.4.0 255.255.255.224

  access extensive list ip 10.4.4.0 inside_nat0_outbound allow 255.255.255.224 192.168.100.0 255.255.255.0

  access extensive list ip 10.4.4.0 inside_nat0_outbound allow 255.255.255.224 10.2.2.0 255.255.255.0

  access extensive list ip 10.4.4.0 inside_nat0_outbound allow 255.255.255.224 172.23.2.0 255.255.255.192

  Here is the list of interesting traffic that we push to the customers through the tunnel of the VPN connection.

  VPN_splitunnel to access extended list ip 192.168.100.0 allow 255.255.255.0 any

  VPN_splitunnel of access list scope 10.2.2.0 ip allow 255.255.255.0 any

  Access extensive list ip 10.12.1.0 VPN_splitunnel allow 255.255.255.0 any

  Access extensive list ip 172.23.2.0 VPN_splitunnel allow 255.255.255.192 all

  Access extensive list ip 10.4.4.0 VPN_splitunnel allow 255.255.255.224 all

  VPN_splitunnel list extended access permit ip host 208.x.x.x any newspaper<- this="" is="" the="" vendors="" external="" ip="" address="" (obfuscated="" for="" security="" but="" you="" get="" the="">

  Here's the rest of the nat configuration:

  NAT-control

  Overall 101 (external) interface

  NAT (inside) 0-list of access inside_nat0_outbound

  NAT (inside) 101 0.0.0.0 0.0.0.0

  Configuring VPN RA:

  IP mask 255.255.255.224 local pool VPNPool 10.4.4.5 - 10.4.4.30

  WebVPN

  allow outside

  AnyConnect essentials

  SVC disk0:/anyconnect-dart-win-2.5.0217-k9.pkg 1 image

  SVC disk0:/anyconnect-macosx-i386-2.5.2001-k9.pkg.zip 2 image

  enable SVC

  tunnel-group-list activate

  internal RAVPN group policy

  RAVPN group policy attributes

  value no unauthorized access to banner

  value of banner that all connections and controls are saved

  banner of value this system is the property of MYCOMPANY

  banner value disconnect IMMEDIATELY if you are not an authorized user.

  value of server WINS 10.12.1.11 10.2.2.11

  value of 10.12.1.11 DNS server 10.2.2.11

  Split-tunnel-policy tunnelspecified

  value of Split-tunnel-network-list VPN_splitunnel

  type tunnel-group RAVPN remote access

  attributes global-tunnel-group RAVPN

  address pool VPNPool

  authentication-server-group NHCGRPAD

  Group Policy - by default-RAVPN

  tunnel-group RAVPN webvpn-attributes

  enable RAVPN group-alias

  Can someone ' a Please direct me as to what I'm doing wrong? I was assuming that since I don't have Ip 208.x.x.x address in the list of inside_nat0_outbound that it would be NAT had, but appears not to be the case (out of packet - trace below)

  Packet-trace entry outside tcp 10.4.4.6 34567 208.x.x.x detailed https

  *****************************************************************************

  Phase: 1

  Type:-ROUTE SEARCH

  Subtype: entry

  Result: ALLOW

  Config:

  Additional information:

  in 0.0.0.0 0.0.0.0 outdoors

  Phase: 2

  Type: ACCESS-LIST

  Subtype: Journal

  Result: ALLOW

  Config:

  Access-group outside_access_in in interface outside

  outside_access_in list extended access permitted ip VPN_ips 255.255.255.224 host 208.x.x.x Journal

  Additional information:

  Direct flow from returns search rule:

  ID = 0xd7bd3b20, priority = 12, area = allowed, deny = false

  Hits = 2, user_data is 0xd613bf80, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol

  SRC ip = VPN_ips, mask is 255.255.255.224, port = 0

  IP = 208.x.x.x DST, mask = 255.255.255.255, port = 0, dscp = 0 x 0

  Phase: 3

  Type: IP-OPTIONS

  Subtype:

  Result: ALLOW

  Config:

  Additional information:

  Direct flow from returns search rule:

  ID = 0xd7df8fa0, priority = 0, sector = inspect-ip-options, deny = true

  hits = 2256686, user_data = 0 x 0, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

  SRC ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

  DST ip = 0.0.0.0 mask = 0.0.0.0, port = 0, dscp = 0 x 0

  Phase: 4

  Type: VPN

  Subtype: ipsec-tunnel-flow

  Result: ALLOW

  Config:

  Additional information:

  Direct flow from returns search rule:

  ID = 0xd87c8fc8, priority = 12, area = ipsec-tunnel-flow, deny = true

  hits = 550, user_data = 0 x 0, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol

  SRC ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

  DST ip = 0.0.0.0 mask = 0.0.0.0, port = 0, dscp = 0 x 0

  Phase: 5

  Type: HOST-LIMIT

  Subtype:

  Result: ALLOW

  Config:

  Additional information:

  Direct flow from returns search rule:

  ID = 0xd7dfbd28, priority = 0, domain = host-limit, deny = false

  hits = 1194, user_data = 0 x 0, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol

  SRC ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

  DST ip = 0.0.0.0 mask = 0.0.0.0, port = 0, dscp = 0 x 0

  Phase: 6

  Type: IP-OPTIONS

  Subtype:

  Result: ALLOW

  Config:

  Additional information:

  Reverse flow from returns search rule:

  ID = 0xd7df8fa0, priority = 0, sector = inspect-ip-options, deny = true

  hits = 2256688, user_data = 0 x 0, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

  SRC ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

  DST ip = 0.0.0.0 mask = 0.0.0.0, port = 0, dscp = 0 x 0

  Phase: 7

  Type: CREATING STREAMS

  Subtype:

  Result: ALLOW

  Config:

  Additional information:

  New workflow created with the 2380213 id, package sent to the next module

  Information module for forward flow...

  snp_fp_tracer_drop

  snp_fp_inspect_ip_options

  snp_fp_tcp_normalizer

  snp_fp_translate

  snp_fp_adjacency

  snp_fp_fragment

  snp_ifc_stat

  Information for reverse flow...

  snp_fp_tracer_drop

  snp_fp_inspect_ip_options

  snp_fp_translate

  snp_fp_tcp_normalizer

  snp_fp_adjacency

  snp_fp_fragment

  snp_ifc_stat

  Result:

  input interface: outdoors

  entry status: to the top

  entry-line-status: to the top

  output interface: outside

  the status of the output: to the top

  output-line-status: to the top

  Action: allow

  *****************************************************************************

  Thank you

  Jason

  You are on the right track with you divided the tunnel configuration. You need to add is the pool of Client VPN to be coordinated to your external ip address, IE: same as your local users of the ASA when he tries to access the intellectual property of the provider (208.x.x.x), allowing more traffic in and out of the same interface for traffic of U-turn.

  Here's what you need to set up:

  permit same-security-traffic intra-interface

  nat-to-vendor ip 10.4.4.0 access list permit 255.255.255.224 host 208.x.x.x

  NAT (outside) 101-list of nat-to-vendor access

  The foregoing will allow VPN pool to be coordinated to your ASA outside the ip address of the interface when accessing the seller (208.x.x.x).

  1 small correction to your ACL split tunnel:

  -The following line is incorrect and should be deleted in the tunnel of split ACL:

  Access extensive list ip 10.4.4.0 VPN_splitunnel allow 255.255.255.224 all

  (As 10.4.4.0/27 is your pool of Client VPN, you do not add these subnet to your list of split tunnel. List of Split tunnel are only the network that you are difficult to access and sent through your VPN tunnel).

  Hope that helps.

• ASA 5505 AnyConnect

  Hello world

  I packed 2 VLAN (VLAN, VLAN B) on ASA 5505, in addition I VLAN 1. When I'm in the VLAN 1 I have access to all devices in VLAN A and B of VLAN (ping, ssh, etc.).

  also I set up a VPN using Anyconnect as described below:

  http://www.TechRepublic.com/blog/smbit/quick-guide-AnyConnect-client-VPN-on-Cisco-ASA-5505/387

  everything works, I can connect, the tunnel is set up, but I have access to the devices in VLAN 1

  could someone help me and tell me what I did wrong?

  Thank you

  Robert

  Hello Robert,.

  Given that your post is not clear on the question, when you wrote "everything works", I'll assume you have problems to access the VLAN A and B you customer annyconnect. It could be a problem with your NAT WITHOUT rules (sheep behavior depends on your Software ASA)

  Please tell us which version of the software you're would be useful as well to help you correctly using and post with your config.

  Jirka

• ASA 5505 Anyconnect traversal nat error

  Good afternoon gents,

  I installed an ASA 5505 and can connect with anyconnect, but when I do, I can't access my LAN, then my LAN can access my laptop.  In the newspapers, I see the following error message:

  Asymmetrical NAT rules matched for flows forward and backward; Connection for udp src outside;10.139.50.1/64506 dst inside 10.201.180.5/53 refused because of the failure of path opposite of that of NAT.

  I can't seem to figure this point and nothing I read to try worked. Here's the relevant config, any help would be GREATLY appreciated.

  interface Vlan1
  nameif inside
  security-level 100
  IP 10.201.180.10 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  IP 67.200.133.107 255.255.255.248
  !

  access extensive list ip 10.139.50.0 inside_nat0_outbound allow 255.255.255.0 10.201.180.0 255.255.255.0
  access extensive list ip 10.201.180.0 inside_nat0_outbound allow 255.255.255.0 10.139.50.0 255.255.255.0

  mask 10.139.50.1 - 10.139.50.50 255.255.255.0 IP local pool SSLClientPool

  Global 1 interface (outside)
  NAT (inside) 0 inside_nat0_outbound list of outdoor access
  NAT (inside) 1 0.0.0.0 0.0.0.0

  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  dynamic-access-policy-registration DfltAccessPolicy
  AAA authentication enable LOCAL console
  the ssh LOCAL console AAA authentication

  Try the nat statement 0 without the keyword on the outside.

  NAT (inside) 0-list of access inside_nat0_outbound

  In addition,

  sh run sysopt and stick out.

  Manish

• ASA 5505 AnyConnect 8.2 connect other subnets from site to site

  Hello

  I'm somehwat new Cisco and routing. I have an installation of two ASA 5505 that are configured for the site to site vpn and AnyConnect. The AnyConnect subnet can connect to inside VLANs to the SiteA but I can't for the remote to Site B subnet when you use AnyConnect. Any ideas? I have to add the subnet of 10.0.7.0/24 to the site to site policy? Do I need to set up several NAT rules? Details below.

  Site A: ASA 5505 8.2

  Outside: 173.X.X.X/30

  Inside: 10.0.5.0/24

  AnyConnect: 10.0.7.0/24

  Site b: ASA 5505 8.2

  Outsdie: 173.X.X.X/30

  Inside: 10.0.6.0/24

  The AnyConnect subnet cannot access the network of 10.0.6.0/24.

  Any help would be greatly appreciated! Thank you!

  Hello Kevin,

  You must go back to identity (outdoors, outdoor) identity NAT (essentially for two subnets (Anyconnect and Remote_IPSec).

  And of course to include traffic in the ACL for IPSec crypto and (if used) split with the Anyconnect tunnel.

  Note all useful posts!

  Kind regards

  Jcarvaja

  Follow me on http://laguiadelnetworking.com

• LAN ASA 5505 VPN client access issue

  Hello

  I'm no expert in ASA and routing so I ask support the following case.

  There is a (running on Windows 7) Cisco VPN client and an ASA5505.

  The objectives are client can use the gateway remote on SAA for Skype and able to access devices in SAA within the interface.

  The Skype works well, but I can't access devices in the interface inside through a VPN connection.

  Can you please check my following config and give me any advice to fix NAT or VPN settings?

  ASA Version 7.2 (4)

  !

  ciscoasa hostname

  domain default.domain.invalid

  activate wDnglsHo3Tm87.tM encrypted password

  2KFQnbNIdI.2KYOU encrypted passwd

  names of

  !

  interface Vlan1

  nameif inside

  security-level 100

  IP 192.168.1.1 255.255.255.0

  !

  interface Vlan2

  nameif outside

  security-level 0

  IP address dhcp setroute

  !

  interface Vlan3

  prior to interface Vlan1

  nameif dmz

  security-level 50

  no ip address

  !

  interface Ethernet0/0

  switchport access vlan 2

  !

  interface Ethernet0/1

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  !

  interface Ethernet0/4

  !

  interface Ethernet0/5

  !

  interface Ethernet0/6

  !

  interface Ethernet0/7

  !

  passive FTP mode

  DNS server-group DefaultDNS

  domain default.domain.invalid

  permit same-security-traffic inter-interface

  permit same-security-traffic intra-interface

  inside_access_in list extended access permitted tcp 192.168.1.0 255.255.255.0 any

  inside_access_in list extended access permitted udp 192.168.1.0 255.255.255.0 any

  outside_access_in list of allowed ip extended access entire 192.168.1.0 255.255.255.0

  pager lines 24

  Enable logging

  asdm of logging of information

  Within 1500 MTU

  Outside 1500 MTU

  MTU 1500 dmz

  local pool VPNPOOL 10.0.0.200 - 10.0.0.220 255.255.255.0 IP mask

  ICMP unreachable rate-limit 1 burst-size 1

  ASDM image disk0: / asdm - 524.bin

  don't allow no asdm history

  ARP timeout 14400

  NAT-control

  Global 1 interface (outside)

  NAT (inside) 1 10.0.0.0 255.255.255.0

  NAT (inside) 1 192.168.1.0 255.255.255.0

  NAT (outside) 1 10.0.0.0 255.255.255.0

  inside_access_in access to the interface inside group

  Access-group outside_access_in in interface outside

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  the ssh LOCAL console AAA authentication

  Enable http server

  http 192.168.1.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto-map dynamic outside_dyn_map pfs set 20 Group1

  Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA

  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

  outside_map interface card crypto outside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  Telnet timeout 5

  SSH 192.168.1.0 255.255.255.0 inside

  SSH timeout 5

  SSH version 2

  Console timeout 0

  dhcpd outside auto_config

  !

  dhcpd address 192.168.1.2 - 192.168.1.33 inside

  dhcpd dns xx.xx.xx.xx interface inside

  dhcpd allow inside

  !

  attributes of Group Policy DfltGrpPolicy

  No banner

  WINS server no

  value of server DNS 84.2.44.1

  DHCP-network-scope no

  VPN-access-hour no

  VPN - connections 3

  VPN-idle-timeout 30

  VPN-session-timeout no

  VPN-filter no

  Protocol-tunnel-VPN IPSec l2tp ipsec webvpn

  disable the password-storage

  disable the IP-comp

  Re-xauth disable

  Group-lock no

  disable the PFS

  IPSec-udp disable

  IPSec-udp-port 10000

  Split-tunnel-policy tunnelall

  Split-tunnel-network-list no

  by default no

  Split-dns no

  Disable dhcp Intercept 255.255.255.255

  disable secure authentication unit

  disable authentication of the user

  user-authentication-idle-timeout 30

  disable the IP-phone-bypass

  disable the leap-bypass

  allow to NEM

  Dungeon-client-config backup servers

  MSIE proxy server no

  MSIE-proxy method non - change

  Internet Explorer proxy except list - no

  Disable Internet Explorer-proxy local-bypass

  disable the NAC

  NAC-sq-period 300

  NAC-reval-period 36000

  NAC-by default-acl no

  address pools no

  enable Smartcard-Removal-disconnect

  the firewall client no

  rule of access-client-none

  WebVPN

  url-entry functions

  HTML-content-filter none

  Home page no

  4 Keep-alive-ignore

  gzip http-comp

  no filter

  list of URLS no

  value of customization DfltCustomization

  port - forward, no

  port-forward-name value access to applications

  SSO-Server no

  value of deny message connection succeeded, but because some criteria have not been met, or because of a specific group policy, you are not allowed to use the VPN features. Contact your administrator for more information

  SVC no

  SVC Dungeon-Installer installed

  SVC keepalive no

  generate a new key SVC time no

  method to generate a new key of SVC no

  client of dpd-interval SVC no

  dpd-interval SVC bridge no

  deflate compression of SVC

  internal group XXXXXX strategy

  attributes of XXXXXX group policy

  Protocol-tunnel-VPN IPSec

  Split-tunnel-policy tunnelall

  Split-tunnel-network-list no

  XXXXXX G910DDfbV7mNprdR encrypted privilege 15 password username

  username password encrypted XXXXXX privilege 0 5p9CbIe7WdF8GZF8

  attributes of username XXXXXX

  Strategy Group-VPN-XXXXXX

  username privilege 15 encrypted password cRQbJhC92XjdFQvb XXXXX

  tunnel-group XXXXXX type ipsec-ra

  attributes global-tunnel-group XXXXXX

  address VPNPOOL pool

  Group Policy - by default-XXXXXX

  tunnel-group ipsec-attributes XXXXXX

  pre-shared-key *.

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  inspect the icmp

  !

  global service-policy global_policy

  context of prompt hostname

  Cryptochecksum:a8fbb51b0a830a4ae823826b28767f23

  : end

  ciscoasa #.

  Thanks in advance!

  fbela

  config #no nat (inside) 1 10.0.0.0 255.255.255.0< this="" is="" not="">

  Add - config #same-Security-permit intra-interface

  #access - extended list allowed sheep ip 192.168.1.0 255.255.255.0 10.0.0.0 255.255.255.0

  #nat (inside) 0 access-list sheep

  Please add and test it.

  Thank you

  Ajay

• ASA 5505 AnyConnect 8.2 - Can't access and inside services

  Hello

  I have configured AnyConnect to use a subnet of 10.0.7.0/24 for its DHCP pool. I can connect to the ASA very well, but I can't access internal services on my subnet 10.0.5.0/24 which is my INNER interface vlan subnet. I configure NAT for exemption rule:

  allowed to Access-list inside_nat0_outbound line 2 extended 10.0.5.0 ip 255.255.255.0 Any-Connect-Pool-10-0-7-0 object-group

  AnyConnect is set to ignore all the ACL rules through the sysopt permit vpn connection.

  I don't know if I'm supposed to create another path to the VPN subnet or what exactly. When I ping my VPN subnet to a client on the subnet of the INTERIOR, I see ICMP traffic flowing through the FW, but I didn't get any answer. I do not split-tunnleing and I can not connect to internet either after establishing a VPN connection.

  Thanks in advance for the help.

  Hello

  You must ensure that the following setting is enabled

  permit same-security-traffic intra-interface

  You should also make sure PAT configured for your Pool of VPN Dynamics

  If your current dynamic PAT for internal users would

  Global 1 interface (outside)

  NAT (inside) 1 10.0.5.0 255.255.255.0

  Then you must add

  NAT (outside) 1 10.0.7.0 255.255.255.0

  Hope this helps

  Remember to mark a reply as the answer if it answered your question.

  Feel free to ask more if necessary

  -Jouni

• ASA 5505 IPSec client-to-site any LAN access?

  Hello

  Like many others, I have problems get ipsec vpn clients can communicate with my LAN.

  I have configure ipsec with the wizard, I have also to add an ACL to allow the network to pool for the vpn client to connect to the local network, but with little success.

  Many of the responses I've seen includes changes in the NAT table, I tried a lot of them, but without success.

  There must be something really simple, that it's so frustrating because I guess it is supposed to be a relatively simple thing to get running.

  VPN client (Linux, iptables rules no) get 10.80.80.100 address, but cannot connect to a TCP service on a machine of LAN (no firewall on computer LAN) and can not ping LAN.

  The VPN client routing table:

  Kernel IP routing table
  Destination Gateway Genmask Flags metric Ref use Iface
  85.24.249.35 212.112.31.254 UGH 255.255.255.255 0 0 0 eth0
  10.80.80.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
  212.112.31.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
  0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 tun0

  : Saved
  
  :
  
  ASA Version 7.2(4)
  
  !
  
  hostname ciscoasa
  
  domain-name default.domain.invalid
  
  enable password xxx encrypted
  
  passwd xxx encrypted
  
  names
  
  !
  
  interface Vlan1
  
  nameif inside
  
  security-level 100
  
  ip address 192.168.0.1 255.255.255.0
  
  !
  
  interface Vlan2
  
  nameif outside
  
  security-level 0
  
  ip address dhcp setroute
  
  !
  
  interface Ethernet0/0
  
  switchport access vlan 2
  
  !
  
  interface Ethernet0/1
  
  !
  
  interface Ethernet0/2
  
  !
  
  interface Ethernet0/3
  
  !
  
  interface Ethernet0/4
  
  !
  
  interface Ethernet0/5
  
  !
  
  interface Ethernet0/6
  
  !
  
  interface Ethernet0/7
  
  !
  
  ftp mode passive
  
  dns server-group DefaultDNS
  
  domain-name default.domain.invalid
  
  same-security-traffic permit inter-interface
  
  access-list tictac_splitTunnelAcl remark allow vpn tunnel users to LAN
  
  access-list tictac_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
  
  access-list inside_nat0_outbound extended permit ip any 10.80.80.0 255.255.255.0
  
  access-list inside_access_in extended permit ip any any log disable
  
  access-list outside_access_out extended permit ip any any
  
  pager lines 24
  
  logging enable
  
  logging asdm informational
  
  mtu outside 1500
  
  mtu inside 1500
  
  ip local pool vpnpool 10.80.80.100-10.80.80.120 mask 255.255.255.0
  
  icmp unreachable rate-limit 1 burst-size 1
  
  asdm image disk0:/asdm-524.bin
  
  no asdm history enable
  
  arp timeout 14400
  
  global (outside) 1 interface
  
  nat (inside) 0 access-list inside_nat0_outbound
  
  nat (inside) 1 0.0.0.0 0.0.0.0
  
  access-group outside_access_out out interface outside
  
  access-group inside_access_in in interface inside
  
  timeout xlate 3:00:00
  
  timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  
  timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
  
  timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
  
  timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  
  http server enable
  
  http 192.168.0.0 255.255.255.0 inside
  
  no snmp-server location
  
  no snmp-server contact
  
  snmp-server enable traps snmp authentication linkup linkdown coldstart
  
  crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
  
  crypto dynamic-map outside_dyn_map 20 set pfs group1
  
  crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
  
  crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
  
  crypto map outside_map interface outside
  
  crypto isakmp enable outside
  
  crypto isakmp policy 10
  
  authentication pre-share
  
  encryption 3des
  
  hash sha
  
  group 2
  
  lifetime 86400
  
  telnet 192.168.0.0 255.255.255.0 inside
  
  telnet timeout 5
  
  ssh timeout 5
  
  console timeout 0
  
  dhcpd auto_config outside
  
  !
  
  dhcpd address 192.168.0.2-192.168.0.33 inside
  
  dhcpd dns 8.8.8.8 4.2.2.2 interface inside
  
  dhcpd enable inside
  
  !
  
  group-policy tictac internal
  
  group-policy tictac attributes
  
  dns-server value 8.8.8.8 4.2.2.2
  
  vpn-tunnel-protocol IPSec
  
  split-tunnel-policy tunnelspecified
  
  split-tunnel-network-list none
  
  username mattiasb password SVCZv/HMkykG.ikA encrypted privilege 0
  
  username mattiasb attributes
  
  vpn-group-policy tictac
  
  tunnel-group tictac type ipsec-ra
  
  tunnel-group tictac general-attributes
  
  address-pool vpnpool
  
  default-group-policy tictac
  
  tunnel-group tictac ipsec-attributes
  
  pre-shared-key *
  
  !
  
  class-map inspection_default
  
  match default-inspection-traffic
  
  !
  
  !
  
  policy-map type inspect dns preset_dns_map
  
  parameters
  
    message-length maximum 512
  
  policy-map global_policy
  
  class inspection_default
  
    inspect dns preset_dns_map
  
    inspect ftp
  
    inspect h323 h225
  
    inspect h323 ras
  
    inspect rsh
  
    inspect rtsp
  
    inspect esmtp
  
    inspect sqlnet
  
    inspect skinny
  
    inspect sunrpc
  
    inspect xdmcp
  
    inspect sip
  
    inspect netbios
  
    inspect tftp
  
  !
  
  service-policy global_policy global
  
  prompt hostname context
  
  Cryptochecksum:6e456ab21d08182ca41ed0f1be031797
  
  : end
  
  asdm image disk0:/asdm-524.bin
  
  no asdm history enable
  
  

  The list of split tunnel network was put on 'none' in your configuration:

  group-policy tictac attributes
  
  dns-server value 8.8.8.8 4.2.2.2
  
  vpn-tunnel-protocol IPSec
  
  split-tunnel-policy tunnelspecified
  
  split-tunnel-network-list none
  
  
  Please configure the tunnel list to reference the split tunnel ACL as follows:
  
  group-policy tictac attributes
  
     split-tunnel-network-list value tictac_splitTunnelAcl

  Hope that helps.

• ASA 5505 VPN Client Ipsec config problems

  I configured the asa the wizard to Setup vpn, but this still does not work properly. Vpn connect without problem, but I can't access all the resources on the 192.168.1.x subnet. Don't know what I'm missing here, here's a copy of my config.

  ASA Version 8.0 (3)
  !
  host name
  domain name
  activate the password
  names of
  !
  interface Vlan1
  nameif inside
  security-level 100
  192.168.1.3 IP address 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  "Public ip" 255.255.255.0 IP address
  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  !
  interface Ethernet0/4
  !
  interface Ethernet0/5
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  !
  passwd
  passive FTP mode
  DNS lookup field inside
  DNS domain-lookup outside
  DNS server-group DefaultDNS
  Server name 192.168.1.28
  domain fmrs.org
  GroupVpn_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
  vpngroup_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
  outside_access_in list extended access permit tcp any any eq pptp
  outside_access_in list extended access will permit a full
  inside_nat0_outbound list of allowed ip extended access all 192.168.99.0 255.255.255.0
  inside_nat0_outbound list of allowed ip extended access entire 192.168.1.0 255.255.255.0
  inside_access_in to access ip 192.168.1.0 scope list allow 255.255.255.0 any
  access extensive list ip 192.168.99.0 inside_access_in allow 255.255.255.0 any
  inside_access_in list of allowed ip extended access all 192.168.99.0 255.255.255.0
  pager lines 24
  Enable logging
  asdm of logging of information
  Within 1500 MTU
  Outside 1500 MTU
  mask 192.168.99.2 - 192.168.99.100 255.255.255.0 IP local pool GroupPool
  ICMP unreachable rate-limit 1 burst-size 1
  ICMP allow any inside
  ICMP allow all outside
  ASDM image disk0: / asdm - 602.bin
  don't allow no asdm history
  ARP timeout 14400
  Global 1 interface (outside)
  NAT (inside) 0-list of access inside_nat0_outbound
  NAT (inside) 1 192.168.1.0 255.255.255.0
  public static tcp (indoor, outdoor) interface 192.168.1.62 pptp pptp netmask 255.255.255.255
  inside_access_in access to the interface inside group
  Access-group outside_access_in in interface outside
  Route outside 0.0.0.0 0.0.0.0 66.76.199.1 1
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout, uauth 0:05:00 absolute
  dynamic-access-policy-registration DfltAccessPolicy
  RADIUS protocol AAA-server fmrsdc
  fmrsdc AAA-server 192.168.1.28
  Timeout 5
  fmrsasa key
  Enable http server
  http 192.168.1.0 255.255.255.0 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
  Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
  Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
  Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
  Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
  Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5
  outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
  outside_map interface card crypto outside
  crypto ISAKMP allow inside
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  No encryption isakmp nat-traversal
  No vpn-addr-assign aaa
  No dhcp vpn-addr-assign
  Console timeout 0
  dhcpd outside auto_config
  !

  a basic threat threat detection
  Statistics-list of access threat detection
  GroupVpn internal group policy
  GroupVpn group policy attributes
  value of server WINS 192.168.1.28
  value of server DNS 192.168.1.28
  Protocol-tunnel-VPN IPSec
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list GroupVpn_splitTunnelAcl
  FMRs.org value by default-field
  ID password cisco
  tunnel-group GroupVpn type remote access
  attributes global-tunnel-group GroupVpn
  address pool GroupPool
  authentication-server-group fmrsdc
  Group Policy - by default-GroupVpn
  IPSec-attributes tunnel-group GroupVpn
  pre-shared-key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  inspect the pptp
  inspect the icmp
  !
  global service-policy global_policy
  context of prompt hostname
  Cryptochecksum:b5df903e690566360b38735b6d79e65e
  : end

  Please configure the following:

  ISAKMP nat-traversal crypto

  management-access inside

  You should be able to ping of the SAA within the IP 192.168.1.3

• How to accompany the IDS in ASA 5505 and 5520?

  Dear All;

  We have the following configuration of HW for the ASA 5505 and ASA 5520, we add the functionality of system of detection of Intrusion (IDS) to the two ASA. My question is: what are the modules required to support this function, and what is the deference between IPS and IDS, fact the same Module both the feature?

  Part number:	Description	QTY.
  ASA5505-BUN-K9	ASA 5505 appliance with SW 10 users, 8 ports, 3DES/AES	1
  CON-SNT-AS5BUNK9	SMARTNET 8X5XNBD ASA5505-BUN-K9	1
  SF-ASA5505 - 8.2 - K8	ASA 5505 Series Software v8.2	1
  CAB-AC-C5	Power supply cord Type C5 U.S.	1
  ASA5500-BA-K9	ASA 5500 license (3DES/AES) encryption	1
  ASA5505-PWR-AC	ASA 5505 power adapter	1
  ASA5505-SW-10	ASA 5505 10 user software license	1
  SSC-WHITE	ASA 5505 hood SSC of the location empty	1
  ASA-ANYCONN-CSD-K9	ASA 5500 AnyConnect Client + Cisco Security Office software	1

  Part number:	Description	QTY.
  ASA5520-BUN-K9	ASA 5520 appliance with SW HA, 4GE + 1FE, 3DES/AES	2
  CON-SNT-AS2BUNK9	SMARTNET 8X5XNBD ASA5520 w/300 VPN Prs 4GE + 1FE3DES/AES	2
  ASA5520-VPN-PL	ASA 5520 VPN over 750 IPsec User License (7.0 only)	2
  ASA-VPN-CLNT-K9	Cisco VPN Client (Windows Solaris Linux Mac) software	2
  SF - ASA - 8.2 - K8	ASA 5500 Series Software v8.2	2
  CAB - ACU	Power supply cord (UK) C13 BS 1363 2.5 m	2
  ASA-180W-PWR-AC	Power supply ASA 180W	2
  ASA5500-BA-K9	ASA 5500 license (3DES/AES) encryption	2
  ASA-ANYCONN-CSD-K9	ASA 5500 AnyConnect Client + Cisco Security Office software	2
  SSM-WHITE	ASA/IPS SSM hood of the location	2

  Thanks in advance.

  Rashed Ward.

  Okay, I was not quite correct in my first post.

  These modules - modules only available for corresponding models of ASA.

  They all can act as IPS (inline mode) or IDS ("Promiscuous" mode), depending on how you configure your policies.

  When acting as IPS, ASA redirects all traffic through the module, then all the traffic is inspected and can be dropped inline if a signature is triggered.

  When she acts as an ID, ASA a few exemplary traffic is the module for inspection, but the actual traffic is not affected by the module, as it's not inline in this case.

  In addition, these modules can be both comdination. That is part of the traffic can be inspected "inline", when some other (more sensitive) traffic can be inspected in promiscuous mode.

  To better understand, familiarize themselves with this link:

  http://www.Cisco.com/en/us/docs/security/ASA/asa84/configuration/guide/modules_ips.html

• connect Cisco VPN client v5 to asa 5505

  I have remote vpn configuration issues between ASA5505 and Cisco VPN client v5. Successfully, I can establish a connection between the client Vpn and ASA and receive the IP address of the ASA. Statistical customer VPN windows shows that packets are sent and encrypted but none of the packages is received/decrypted.

  Cannot ping asa 5505

  Any ideas on what I missed?

  Try adding...

  ISAKMP nat-traversal crypto

  In addition, you cannot ping the inside interface of the ASA vpn without this command...

  management-access inside

  Please evaluate the useful messages.

• Unable to connect to ASA 5505 with AnyConnect after upgrade to 8.2

  I just bought a license of VPN AnyConnect Essentials for my ASA 5505.  I had to spend to 8.2 ASA.

  Now that I updated and installed the license, the AnyConnect client will connect is no longer.  It gives the following error: "failed to process the response.

  You can provide any help would be appreciated.  I am pleased to provide you with the configuration information that might be useful if you can provide the CLI commands, you want that I run.

  Looks like he doesn't like THEM too, you can change the encryption algorithm to 'not' include in your strategy:

  3des-sha1-aes128-sha1 sha1 aes256 encryption SSL

  In general is not very safe anyway, and the choice of encryption above will provide you with the best encryption strategy.

  Hope that helps.

• ASA - 5505 / good S2S / RemoteAccess with slow AnyConnect

  Hi all

  I use two ASA 5505 to sites. VPN between two works fine and fast that allows our ISP (~ 10MBit up/down).

  At home, I have normal ADSL (~ 600kbit up / down 6 Mbit)

  Downloading files from home on the internal server is fast, but when I connect through AnyConnect it is horrible slow.

  Both with the same zipfile on http server:

  The download speed with AnyConnect: 90 - 120 KB/s

  Download without AnyConnect speed: 660 KB/s

  Download the same file on the client to the other site of the Site 2 Site VPN server works quickly with 945 KB/s.

  I thought that maybe it's a ServicePolicyRule with QoS, but there are only the default rule where the QoS tab is not available and only ProtocolInspections are selectable.

  ASA 9.1.2

  ASDM 7.1.3

  AnyConnect Client 3.1.04063

  Any idea or suggestion?

  Well cordially

  Chris

  Hi Chris,

  Try lowering the value of mtu anyconnect 'anyconnect mtu 1300' in the group policy, and then test the question.

  You experience slowness for the internet traffic or for accessinng servers behind the ASA?

  Using fractionation on SAA tunnel?

  Kind regards

  NGO

• Client VPN Cisco ASA 5505 Cisco 1841 router

  Hello. I'm doing a connection during a cisco vpn client and a vpn on one server asa 5505 behind a 1841 router (internet adsl2 + and NAT router).

  My topology is almost as follows

  customer - tunnel - 1841 - ASA - PC

  ASA is the endpoint vpn (outside interface) device. I forward udp port 500 and 4500 on my router to the ASA and the tunnel rises. I exempt nat'ting on the asa and the router to the IP in dhcp vpn pool. I can connect to my tunnel but I can't "see" anything in the internal network. I allowed all traffic from the outside inwards buy from the ip vpn pool and I still send packets through the tunnel and I get nothing. I take a look at the statistics on the vpn client and I 2597 bytes (ping traffic) and there are no bytes. Any idea?

  Where you you logged in when you took the "crypto ipsec to show his"? If this isn't the case then try again, also this option allows IPSEC over UDP 4500 and it is disabled, enable it.

  ISAKMP nat-traversal crypto

  Just enter the command as it is, then try to connect again after activation of this option and get the same result to see the.

• ASA AnyConnect client is unable to obtain the IP address of the remote DHCP server

  I and ASA with 10 client AnyConnect profiles set up to get their IP address of my Windows DHCP server.

  It was working fine yesterday.

  I saved the config and rebooted the device.

  Now it won't deliver to my vpn clients intellectual property.

  I don't understand what is happening.

  If I change the profiles to use a local pool he assigns an IP address and works very well.

  But I can't use the local pools.  I have to use the DHCP server on the local network.

  The ONLY thing that was made was that a license allowing the AnyConnect Essentials has been installed recently.

  I get this in debugging:

  6 August 30, 2011 10:44:39 DAP: test49, Addr 107.44.142.20 user, connection AnyConnect: following DAP records were selected for this connection: DfltAccessPolicy

  6 August 30, 2011 10:44:39 group user IP <107.44.142.20>AnyConnect parent session began.

  7 August 30, 2011 10:44:39 IPAA: received message 'UTL_IP_ [IKE_] ADDR_REQ.

  6 August 30, 2011 10:44:39 IPAA: attempt to query DHCP 1 successful

  6 August 30, 2011 10:44:39 IPAA: DHCP configured, the request succeeded for tunnel-group "MCSO-mobile."

  6 August 30, 2011 10:44:39 172.18.4.7 67 172.18.1.46 67 Built UDP outgoing connection 30957 for Internal:172.18.1.46/67 (172.18.1.46/67) at identity:172.18.4.7/67 (172.18.4.7/67)

  7 August 30, 2011 10:44:39 192.168.6.1 built ISP1:192.168.6.1 local-home

  6 August 30, 2011 10:44:39 172.18.1.46 1 192.168.6.1 0 built outgoing ICMP connection for faddr gaddr laddr 172.18.1.46/1 172.18.1.46/1 192.168.6.1/0

  6 August 30, 2011 10:44:41 172.18.1.46 67 192.168.6.0 67 Built UDP outgoing connection 30960 for ISP1:192.168.6.0/67 (192.168.6.0/67) at Internal:172.18.1.46/67 (172.18.1.46/67)

  6 August 30, 2011 10:44:42 192.168.6.1 0 172.18.1.46 1 connection disassembly ICMP for faddr gaddr laddr 172.18.1.46/1 172.18.1.46/1 192.168.6.1/0

  7 August 30, 2011 10:44:52 IPAA: message received 'UTL_IP_DHCP_INVALID_ADDR '.

  4 August 30, 2011 10:44:52 IPAA: could not get the address of the local strategy group or tunnel-group pools

  Well, your config looks good. You also upgrade the operating system? Maybe you hit a new bug.

  I heard no problems after the installation of a license, but it might be interesting to open a TAC case and learn if you hit a bug.