Cannot ping the Anyconnect client IP address to LAN

Hi guys,.

I have an old ASA5520 running 9.1 (6) 8 where I installed Anyconnect SSL split tunneling access:

See establishing group policy enforcement
attributes of Group Policy DfltGrpPolicy
VPN-tunnel-Protocol ikev1, ikev2 clientless ssl

lanwan-gp group policy internal
gp-lanwan group policy attributes
WINS server no
DNS server no
VPN - connections 1
client ssl-VPN-tunnel-Protocol
Split-tunnel-policy tunnelspecified
Split-tunnel-network-list value lanwan-acl
by default no
WebVPN
AnyConnect value lanwan-profile user type profiles

permit for line lanwan-acl access-list 1 standard 172.16.0.0 255.254.0.0 (hitcnt = 48) 0xb5bbee32

Now I can ping, RDP, etc. of any VPN host connected to any destination within 172.16.0.0 255.254.0.0 range.

Here is my routing information:

See the road race
Route outside 0.0.0.0 0.0.0.0 69.77.43.1 1
Route inside 172.16.0.0 255.254.0.0 172.25.8.1 1

interface GigabitEthernet0/1
nameif inside
security-level 100
IP 172.25.8.4 255.255.254.0

But I can't ping any Anyconnect VPN client connected from my LAN.

See the establishment of performance ip local pool

mask IP local pool lanwan-pool 172.25.9.8 - 172.25.9.15 255.255.254.0

Here's the traceroute of LAN:

C:\Users\Florin>tracert d 172.25.9.10

Determination of the route to 172.25.9.10 with a maximum of 30 hops

1 1 ms<1 ms="" 1="" ms="">
2<1 ms="" *=""><1 ms="">
3 * the request exceeded.
4 * request timed out.

While the ASA routing table has good info:

show route | I have 69.77.43.1

S 172.25.9.10 255.255.255.255 [1/0] via 69.77.43.1, outdoors

Other things to mention:

-There is no other FW between LAN and the ASA

-There is no FW or NAT configured or enabled on this ASA(see her running nat and see the race group-access they return all two virgins).

-FW Windows on the Anyconnect workstation is disabled (the service is running). I also tested and able to ping to my workstation Anyconnect House of another device on the same network.

So, I'm left with two questions:

1. first a I do not understand: after reading some threads here, I added this line standard lanwan-acl access-list allowed 69.77.43.0 255.255.255.0

out of ping and tracert commands remains the same, but now I can RDP to the docking station VPN connected to any workstation LAN;

What happens here?

2. how can I do ICMP work after all? I also tried fixup protocol icmp and icmp Protocol Error Correction, still no luck

Thanks in advance,

Florin.

Hi Florin,

The entire production is clear enough for me

in debugging, you can see that traffic is constituent of the ASA

"Inside ICMP echo request: 172.17.35.71 outside: 172.25.9.9 ID = 22 seq = 14024 len = 32.

the SAA can be transferred on or can be a downfall for some reason unknow

can we have a wireshark capture on the vpn client to see if the icmp request is to reach the customer? I want to just isolate the problem of fw so that we can concentrate on the ASA rather than silly windows ;) fw

made the RDP Protocol for VPN client for you inside the LAN work?

run logging on ASA and ping and then inside to VPN client and the Coachman connects on the firewall, if ASA comes down the pkt it will appear in the log.

loggon en
debug logging in buffered memory

#sh logging buffere | in icmp

#Rohan

Tags: Cisco Security

Similar Questions

  • Cannot ping the Virtual Machine by host

    Hi all,

    Please help, I use VMWare Workstation 6.5 and I have a physical operating system which is Windows XP SP2, I have a network card, but not connected to a physical switch, the IP address is 192.168.0.1. I installed a Virtual Machine using Microsoft Windows 2003 server as the operating system, promote as domain controller, install the DHCP, DNS service and assign an IP 192.168.0.2, no default gateway.

    My VMnet1 on physical operating system has an IP 192.168.204.1 and VMNet8 has an IP 192.168.126.1.

    The host, I cannot ping the 192.168.0.2 which is the IP address of the Virtual Machine. Even in the Virtual Machine, I can not ping 192.168.0.1 is the IP address of the host. From what I read, the physical and the virtual machine were connected with a virtual switch. Am I wrong?

    Any advice?

    Thanks in advance.

    They SEEM to be in different networks, you need search routing between them,... since they differnet networks...

    on the other

    they do host and the virtual machine on the same subnet / network for EXAMPLE: class C class network 192.168.200.0/24

    granting of points if my answer was helpful... Thank you > > > > > > > >

    concerning

    Joe

  • SSL VPN without disabled in ASA5505 after the Activation of the AnyConnect client

    Hello everyone,

    I am facing a problem with the VPN service in ASA 5505. Initially, I was using SSL VPN without customer who was working absolutely fine, no problem. Recently I bought AnyConnect Essentials License with license AnyConnect VPN, Mobile (for focusing on the Client SSL VPN Service for desktop and mobile respectively) and have activated these keys inside of the firewall. After that I may be able to connect to based on the VPN Client, using the AnyConnect client. Clientless VPN access is not allowing you to connect and displays an error (see the attached screenshot).

    I created two VPN profiles Viz, basic (for clientless VPN) and rvsvpn (for client based VPN). Download the AnyConnect Client I can connect to the rvsvpn profile. But if I try to connect using the basic profile, it throws an error has been to what is displayed in the exhibition.

    Please help me in this regard, as what can be done to use both the vpn connection profile. Or what the use of AnyConnect disables client access?

    Waiting for your help.

    Thanks in advance.

    Samrat.

    "Anyconnect essentials" in your configuration command to disable all profiles without customer (as well as other features that require the Premium license).

    Essentials and Premium are mutually exclusive as the performance of duties. You can have both installed licenses, but only use one or the other (and never both at once) in your running configuration.

  • Using VPN to push the update of the AnyConnect client

    Hello - we would use our ASA VPN device to push the latest AnyConnect to our user base. Previously, due to the requirement that the user has administrator rights to install, we could not do this and had to return to SCCM to push upgrades the AnyConnect client. We now have software that will allow the client to load as an administrator, even if the user is not an administrator on the system. Viewfinity is the name of the software.

    My question is on the speed control. I don't want to set up the VPN to push the new AnyConnect, and every user who logs in then gets the installation. We would rather control, based on the group if possible, which gets the new client. This limits the risk if there is a problem to a subset of VPN users and not all that connect and you're trying to download. I can't find a config or config guide which indicates that it is possible. What is there, no one knows if it is or isn't an option? If this isn't the case, we would have to assume a lot of risk for new customers of 1100 deployment in a day, a number of type we plugged on any given business day. Please notify.

    Thank you very much for your help.

    The f

    Hi Jeff,

    There is no option to enable the auto update by connecton profile.

    What you can do however, is to disable this feature on the XML profile, since the XML profile can be defined by group policy, you simply deploy the profile either by having users connect to the specific group tunnel where group policy with the No auto update profile XML or deploy the XML profile manually on each machine.

    Please see this:

    Automatic update

    true

    (Default) Automatically install new packages.

    fake

    Doesn't install new pacakges.

    http://www.Cisco.com/en/us/docs/security/vpn_client/AnyConnect/anyconnect30/Administration/Guide/ac13vpnxmlref.html#wp1220030

    In the profile XML (to disable):

    fake

    Where to find the profile?

    OPERATING SYSTEM

    The directory path

    Windows 7 and Vista

    C:\ProgramData\Cisco\Cisco AnyConnect secure mobility Client\Profile\

    Windows XP

    C:\Document and Settings\All Users\Application Data\Cisco\Cisco AnyConnect secure mobility Client\Profile

    MAC OS X and Linux

    / opt/cisco/anyconnect/profile /.

    http://www.Cisco.com/en/us/docs/security/vpn_client/AnyConnect/anyconnect30/Administration/Guide/ac02asaconfig.html#wp1409000

    Let me know.

    Thank you.

    Portu.

    Please note all messages that you find useful.

    Post edited by: Javier Portuguez

  • Option 'The Anyconnect client profile' missing in ASDM

    Hello

    I am trying to configure Anyconnect on the SAA and have successfully updated licensing, as well as downloaded the pkg anyconnect for web deployment. I activated anyconnect on the external interface and can now have the ASA push the client machine. Works very well. However, I would like to add the backup servers that the client will attempt to reach where the primary is down. I understand that "customer profiles" can be created to customize the parameters as follows. Problem is, when I followed the setup guide with instructions for the manufacture of customer profiles here:

    http://www.Cisco.com/en/us/docs/security/vpn_client/AnyConnect/anyconnect30/Administration/Guide/ac02asaconfig.html#wp1289905

    It shows that I should have an option for the Anyconnect Client profile and settings of the Anyconnect Client.

    I don't have one of these options in ASDM. Here's what it shows mine:

    I have another 'Profiles of Client SSL' option, but it does not appear the same as the above.

    Can anyone help with what I have to do to get the customer profiles option to be available, so I can add backup server for the customer information? Thank you!

    It could be your version ASDM. I note, however, that the Release Notes for ASDM for 6.3 (1) Note that this version (when combined with the support ASA 8.3 (1)) introduced the AnyConnect profile editor.

    You can run the 6.4 (7) Version ASDM curent with your ASA remaining on 8.2 (1). It would not hurt to try this.

    A little more awkward alternative is to use the stand-alone profile AnyConnect editor and manually deploy the xml profiles that result.

  • Username, preserved in the AnyConnect Client user name dialog box

    I have one question remains on my client anyconnect 2.5.2006. The user in the dialog box name is cached. We do not want to be cached and have users to enter their username every time.

    Shilpa Gupta mentioned on another post of mine. I was wondering if anyone has any other thoughts! The 2.5.2006 resolved customer I had another question, so come back to 2.4 is not an option at this point.

    For clearing up the credentials in the dialog box when using AnyConnect I found one of the bug:-

    CSCsx76993

    Symptom:

    User credentials are cached in the preferences.xml file when you use the Anyconnect client.  So when they revive Anyconnect, the user name is displayed in the client.

    Conditions:

    You can see all the client anyconnect.  It is a configurable option in the IPSec client.

    Workaround solution:

    Currently there is no work around

    And I can see it resolved in 2.4.202 however, I'm not sure if its fixed in 2.5 also. For this I would like to hear from others.

    Kind regards

    Shilpa

    Hello

    All bug fixes and new features in 2.4.x are also in 2.5.

    However the "bug" Shilpa has pointed out, is not really a bug, but an enhancement request, in other words in 2.3 before the cached username is expected behavior and is always the default behavior in the 'fixed' versions, so just the upgrade won't change anything. What has changed is that now you can change the behavior by defining a new parameter RestrictPreferenceCaching in the local policy file:

    http://www.Cisco.com/en/us/docs/security/vpn_client/AnyConnect/anyconnect25/Administration/Guide/ac04localpolicy.html#wp1055429

    So for example the addition

        All

    your local police should achieve what you want.

    HTH

    Herbert

  • After that stright connected to iSCSI (initiator) Host cannot ping the server iSCSI (target), but the target can, why?

    After that host on vSHere 4.0 strightly connected to iSCSI (initiator) host cannot ping the server iSCSI (target), but target can.  And iSCSI works well. I mean I can create and use the iSCSI disk, why? It makes me confused.

    Thank you!

    Geoarge,

    iSCSI traffic uses a VMkernel port, instead of using the command 'ping', use 'vmkping '.

    André

  • VPN Site-to-Site - cannot ping the router's internal IP address

    Hi guys,.

    I configured a VPN site-to site between two routers, everything works well except ping the internal (LAN) IP of a router.

    Everything works fine: ping the hosts through the tunnel in both feel.

    Routers that I use:

    -IOS 1841: M3 15.0 (1)

    -2811 IOS: 15.0 (1) M5-> here is the problem. I can't ping the inside interface of the router.

    I checked its ipsec counters and it seems that it does not send packets through the tunnel when I ping from the LAN interface.

    #pkts program is not incrementing.

    Anyone had this problem before?

    Thank you very much.

    Best regards

    I think that happens because when the router responds to icmp request he gets is outside interface IP (not the IP Address of the inside interface, wich you are trying to ping) as the source of a package. If icmp-response does not go in the tunnel, because the IP address in the router's external interface is not included in the crypto-acl.

    Solution to this, if it's correct guess, is to add the router's external IP to the crypto-acl.

  • VPN - cannot ping the next hop

    Then some advice... I have configured a server VPN - pptp on my router, create a vpn for the customer at the site. For the moment, the client computer can connect and a connection to the router. I can ping from client to the router (192.168.5.1) but cannot ping 192.168.5.2 (switch) or 192.168.10.X (workstations)

    What I try to achieve is to access the internal network (192.168.10.X), which is the end of the layer 3 switch. Any help/extra eyes would be good.

    Here is my design of the network and the config below:

    Client computer---> Internet---> (1.1.1.1) Cisco router (192.168.5.1) 881---> switch Dell Powerconnect 6248 (192.168.5.2)--> Workstation (192.168.10.x)

    Router Cisco 881

    AAA new-model

    !

    AAA of authentication ppp default local

    !

    VPDN enable

    !

    !

    VPDN-group VPDN PPTP

    !

    accept-dialin

    Pptp Protocol

    virtual-model 1

    !

    interface FastEthernet0

    Description link to switch

    switchport access vlan 5

    !

    interface FastEthernet1

    no ip address

    !

    interface FastEthernet2

    no ip address

    !

    interface FastEthernet3

    switchport access vlan 70

    no ip address

    !

    interface FastEthernet4

    Description INTERNET WAN PORT

    IP [IP EXTERNAL address]

    NAT outside IP

    IP virtual-reassembly in

    full duplex

    Speed 100

    card crypto VPN1

    !

    interface Vlan1

    no ip address

    !

    interface Vlan5

    Description $ES_LAN$

    IP 192.168.5.1 255.255.255.248

    no ip redirection

    no ip unreachable

    IP nat inside

    IP virtual-reassembly in

    !

    interface Vlan70

    IP [IP EXTERNAL address]

    IP virtual-reassembly in

    IP tcp adjust-mss 1452

    !

    !

    !

    interface virtual-Template1

    IP unnumbered FastEthernet4

    encapsulation ppp

    peer default ip address pool defaultpool

    Ms-chap PPP chap authentication protocol

    !

    IP local pool defaultpool 192.168.10.200 192.168.10.210

    IP forward-Protocol ND

    IP http server

    23 class IP http access

    local IP http authentication

    IP http secure server

    IP http timeout policy inactive 600 life 86400 request 10000

    !

    overload of IP nat inside source list no. - NAT interface FastEthernet4

    IP route 0.0.0.0 0.0.0.0 [address IP EXTERNAL]

    Route IP 192.168.0.0 255.255.0.0 192.168.5.2

    !

    No. - NAT extended IP access list

    deny ip 192.168.0.0 0.0.255.255 10.1.0.0 0.0.255.255

    IP 192.168.0.0 allow 0.0.255.255 everything

    VLAN70 extended IP access list

    ip [IP EXTERNAL] 0.0.0.15 permit 192.168.10.0 0.0.1.255

    permit tcp [IP EXTERNAL] 0.0.0.15 any eq smtp

    permit tcp [IP EXTERNAL] 0.0.0.15 any eq www

    permit any eq 443 tcp [IP EXTERNAL] 0.0.0.15

    permit tcp [IP EXTERNAL] 0.0.0.15 any eq field

    permits any udp [IP EXTERNAL] 0.0.0.15 eq field

    list of IP - VPN access scope

    IP 192.168.10.0 allow 0.0.1.255 10.1.0.0 0.0.1.255

    Licensing ip [IP EXTERNAL] 0.0.0.15 10.1.0.0 0.0.1.255

    WAN extended IP access list

    !

    Layer 3 switch - Dell Powerconnect 6224

    !

    IP routing

    IP route 0.0.0.0 0.0.0.0 192.168.5.1

    interface vlan 5

    name "to connect to the Cisco router.

    Routing

    IP 192.168.5.2 255.255.255.248

    output

    !

    interface vlan 10

    "internal network" name

    Routing

    IP 192.168.10.1 255.255.255.0

    output

    !

    interface ethernet 1/g12

    switchport mode acesss vlan 5

    output

    !

    interface ethernet 1/g29

    switchport mode access vlan 10

    output

    !

    Hi Samuel,.

    I went through your configuration and picked up a few problematic lines...

    First of all, you can't have your vpn-pool to be in the range of 192.168.10.x/24, because you already have this subnet used behind the switch (this would be possible if you had 192.168.10.x range connected directly to the router). In addition, you may not link your virtual model to the WAN ip address, it must be bound to an interface with a subnet that includes your IP vpn-pool range.

    The cleaner for this is,

    Create a new interface of back of loop with a new subnet

    !

    loopback interface 0

    192.168.99.1 IP address 255.255.255.0

    !

    New vpn set up, pool

    !

    IP local pool defaultpool 192.168.99.200 192.168.99.210

    !

    Change your template to point the new loopback interface,

    !

    interface virtual-Template1

    IP unnumbered loopback0

    encapsulation ppp

    peer default ip address pool defaultpool

    Ms-chap PPP chap authentication protocol

    !

    All vpn clients will get an IP address of 192.168.99.200 192.168.99.210 range. And they will be able to get the router and up to the desired range 192.168.10.x/24 behind the router. Packages get the switch, then to the host. Host will respond through the gateway (switch)-> router-> Client.

    PS: Sooner, even if your packages arrive at the host, the host will never try to send the response back through the gateway (switch) packets because STI (hosts) point of view, the package came from the same local network, so the host will simply try to "arp" for shippers MAC and eventually will expire)

    I hope this helps.

    Please don't forget to rate/brand of useful messages

    Shamal

  • Unable to ping the remote host IP address

    I have a home network with 2 desktop computers, printer, TV and BlueRay attached.  The PC is both XP and members of the same workgroup.  I can't get the connectivity between the PC 2.  With 1 PC, I ping successfully all connected devices, with the exception of 2 PC.  2 PC, I ping equipment successfully connected, including 1 PC...  I get the same information using a different router and a different network on 2 PC card.

    I tried the following steps of the Article 314067:

    1. check on two PC's TCP/IP configuration.  Result: good on both PCs.

    2. use the ping tool to test connectivity.

    • Ping the loopback address.  Result: good on both PC
    • Ping to the IP address of the local computer.  Result: good on both PC
    • Ping the IP address of the default gateway.  Result: good on both PCs.
    • Ping to the IP address of the remote host.  Result: bad on PC 1, good on PC 2
    • Ping other IP addresses on the network.  Result: good on both PCs.
    • Ping the host name of the other PC.  Result: bad on PC 1, good on PC 2

    Article:

    If the ping command fails, the remote host may not be responding, or there may be a problem with the hardware of network between computers. To the rule

    on a remote host does not respond, use Ping again to a different remote host.

    If you cannot use Ping successfully at any time, verify the following configurations:

    1. Make sure that the IP address of the local computer is valid and that it is correct on the

    Tab general of the Internet Protocol (TCP/IP) properties dialog or box when it is used with the Ipconfig tool.  Result: good on both PC

    Make sure that the default gateway is configured and that the link between the host and the default gateway works. For the purposes of troubleshooting, make sure that this gateway by default is configured. You can configure multiple default gateways, gateways after the first gateway is used only if the IP stack determines that the original gateway is not working. Diagnosis is to determine the State of the first configured gateway. Therefore, you can delete all the other gateways to simplify your task.  Result: good on both PC
    Make sure that Internet Protocol security (IPSec) is not enabled. According to the IPSec policy, Ping packets may be blocked or may require security. For more information about IPSec, go to method 7: Verify Internet Protocol security (IPSec).  Result: good on both PC

    Thanks for your suggestions you may have.

    Hello

    Firewall such as Norton, McAfee etc can cause a loss of network connectivity, even when the network is correctly configured. Try disabling the firewall on both computers to see if the ping works.

    Tricky

  • Cisco 5505, inside, I cannot ping the external IP of the router, but inside I can ping anything else

    Hello

    5505 Cisco's internal IP: 10.10.0.1 static, securty level 100

    External IP of Cisco 5505: 36.X.X.23 Dhcp, 0 security level

    of within peut all host external example ping by host 10.10.0.3 to google.com

    inside peut ping all domestic example of the host, host 10.10.0.3 to 10.10.0.5 included the internal IP of Cisco 10.10.0.1

    inside peut ping ip network address different on the same network from my router external example the host 36.x.x.25

    cannot ping inside the IP 36.X.X.23?

    from outside peuvent ping the IP 36.X.X.23

    outside peuvent ping different extenal network 36.X.X.X network ip

     
    How can I ping the 36.X.X.23 of the Interior, any suggestions?

    It's called background management which is not supported in the ASA

    https://Tools.Cisco.com/bugsearch/bug/CSCtd86651

    That's why is not and this will never work the ASA design does not

    It will be useful.

  • Automatic demotion of the Anyconnect Client (router IOS)

    Hello

    We run a Cisco Anyconnect client with a router IOS environment (2921) as the lead aircraft.

    We have upgraded the client package on the router to the latest version 3.1.13015. After installing this package on the customers, we discovered a bug. Windows-based computers are not able to establish a VPN connection more (authentication and auto-package-level still works, but then an error message is displayed ("unable to cannot" or similar).)

    I returned the package on the router back to an older version (3.1.11004), but is not beeing auto-installe when a client with the new version (buggy) connects.

    Is it possible to configure the router to force a downgrade to the customers, or is the only way to workaround to manually uninstall the package on clients?

    Thank you

    Heinz

    No you can't auto-downgrade the station clients.

    Unfortunately, you will need to uninstall it from the client end, then get the right package (older) of the router.

  • Get the Thin Client IP address

    Hello. I'm trying to find out the IP address of the machine that I use for programming. I want to use my LabVIEW program on a server. However, the string to the property intellectual VI gives the IP address of the network, so in this case the server IP address. It is a problem, as we hope, in the future, run multiple thin on program clients, if we want the program to know what thin client, it works on. However, I don't have access to the command prompt on the thin client due to administrative restrictions. This eliminates the other solution I found, which was to find the Login Windows user name (each light client has its own unique user name) through different screw which involved the command prompt. Any ideas on how to find the IP address of the customer of the Services Terminal Server Session, I believe that my computer called? Thanks for your time.

    I called and he was referred to this, which worked. We use Citrix server and the username thing worked, and we are now able to run the program for each thin client using his user name.

  • Site to site VPN tunnel - cannot ping the second interface of the firewall peer inside2

    I have two ASA 5505 firewall each with a basic license: FWa and FWb. currently there is a VPN tunnel between them work. I added a second (inside2) interface to the firewall, FWb, but I can't ping firewall FWa, so that I can ping the inside interface of FWa.

    I can ping the FWb inside interface 192.168.20.1 from the FWa inside 172.16.1.1 interface, but I can not ping to the 10.52.100.10 of the FWa FWb inside2 interface. I can not ping the gateway host FWa 10.52.100.1.

    I show the essential configuration of two firewalls as well as the debug icmp output on the two firewalls that I ping the internal interfaces and of FWa FWb inside2.
    =========================================================

    Here is a skeleton of the FWa configuration:

    name 172.16.1.0 network-inside
    name 192.168.20.0 HprCnc Thesys
    name 10.52.100.0 ring52-network
    name 10.53.100.0 ring53-network
    name S.S.S.S outside-interface

    interface Vlan1
    nameif inside
    security-level 100
    IP 172.16.1.1 255.255.255.0
    !
    interface Vlan2
    Description Connection to 777 VLAN to work around static Comast external Modem and IP address.
    nameif outside
    security-level 0
    outside interface IP address 255.255.255.240

    the DM_INLINE_NETWORK_5 object-group network
    network-object HprCnc Thesys 255.255.255.0
    ring52-network 255.255.255.0 network-object
    ring53-network 255.255.255.0 network-object

    the DM_INLINE_NETWORK_3 object-group network
    ring52-network 255.255.255.0 network-object
    network-object HprCnc Thesys 255.255.255.0
    ring53-network 255.255.255.0 network-object

    outside-interface of the access-list extended permitted Outside_5_cryptomap ip host object-group DM_INLINE_NETWORK_3
    inside_nat_outbound list extended access allowed inside-network ip, 255.255.255.0 DM_INLINE_NETWORK_5 object-group
    permit access list extended ip host 173.162.149.72 Outside_nat0_outbound aus_asx_uat 255.255.255.0

    NAT (inside) 0 access-list sheep
    NAT (inside) 101-list of access inside_nat_outbound
    NAT (inside) 101 0.0.0.0 0.0.0.0
    NAT (outside) 0-list of access Outside_nat0_outbound

    card crypto VPN 5 corresponds to the address Outside_5_cryptomap
    card crypto VPN 5 set pfs Group1
    VPN 5 set peer D.D.D.D crypto card
    VPN 5 value transform-set VPN crypto card
    tunnel-group D.D.D.D type ipsec-l2l
    IPSec-attributes tunnel-Group D.D.D.D
    pre-shared key *.

    =========================================================

    FWb:

    name 10.52.100.0 ring52-network
    name 10.53.100.0 ring53-network
    name 10.51.100.0 ring51-network
    name 10.54.100.0 ring54-network

    interface Vlan1
    nameif inside
    security-level 100
    address 192.168.20.1 255.255.255.0
    !
    interface Vlan2
    nameif outside
    security-level 0
    address IP D.D.D.D 255.255.255.240
    !
    interface Vlan52
    prior to interface Vlan1
    nameif inside2
    security-level 100
    IP 10.52.100.10 255.255.255.0

    the DM_INLINE_NETWORK_3 object-group network
    ring52-network 255.255.255.0 network-object
    ring53-network 255.255.255.0 network-object

    the DM_INLINE_NETWORK_2 object-group network
    ring52-network 255.255.255.0 network-object
    object-network 192.168.20.0 255.255.255.0
    ring53-network 255.255.255.0 network-object

    inside_nat0_outbound to access extended list ip 192.168.20.0 allow 255.255.255.0 host S.S.S.S
    inside2_nat0_outbound list extended access allowed object-group DM_INLINE_NETWORK_3 S.S.S.S ip host

    outside_1_cryptomap list extended access allowed object-group DM_INLINE_NETWORK_2 S.S.S.S ip host

    NAT (inside) 0-list of access inside_nat0_outbound
    NAT (inside) 1 0.0.0.0 0.0.0.0
    inside2_nat0_outbound (inside2) NAT 0 access list
    NAT (inside2) 1 0.0.0.0 0.0.0.0

    Route inside2 network ring51 255.255.255.0 10.52.100.1 1
    Route inside2 network ring53 255.255.255.0 10.52.100.1 1
    Route inside2 network ring54 255.255.255.0 10.52.100.1 1

    card crypto outside_map 1 match address outside_1_cryptomap
    card crypto outside_map 1 set pfs Group1
    outside_map game 1 card crypto peer S.S.S.S
    card crypto outside_map 1 set of transformation-ESP-3DES-SHA
    outside_map interface card crypto outside

    tunnel-group S.S.S.S type ipsec-l2l
    IPSec-attributes tunnel-group S.S.S.S
    pre-shared key *.

    =========================================================================
    I'm Tournai on icmp trace debugging on both firewalls and could see the traffic arriving at the inside2 interface, but never return to FWa.

    Ping Successul FWa inside the interface on FWb

    FWa # ping 192.168.20.1
    Type to abort escape sequence.
    Send 5, echoes ICMP 100 bytes to 192.168.20.1, time-out is 2 seconds:
    Echo request ICMP from outside-interface to 192.168.20.1 ID = 32068 seq = 23510 len = 72
    ! ICMP echo reply to 192.168.20.1 in outside-interface ID = 32068 seq = 23510 len = 72
    ....

    FWb #.
    Echo ICMP of S.S.S.S to 192.168.20.1 ID request = 32068 seq = 23510 len = 72
    ICMP echo reply 192.168.20.1 S.S.S.S ID = 32068 seq = 23510 len = 72
    ==============================================================================
    Successful ping of Fwa on a host connected to the inside interface on FWb

    FWa # ping 192.168.20.15
    Type to abort escape sequence.
    Send 5, echoes ICMP 100 bytes to 192.168.20.15, wait time is 2 seconds:
    Echo request ICMP from outside-interface to 192.168.20.15 ID = seq 50862 = 18608 len = 72
    ! ICMP echo reply to 192.168.20.15 in outside-interface ID = seq 50862 = 18608 len = 72
    ...

    FWb #.
    Inside outside:S.S.S.S ICMP echo request: 192.168.20.15 ID = seq 50862 = 18608 len = 72
    ICMP echo reply to Interior: 192.168.20.15 outside:S.S.S.S ID = seq 50862 = 18608 len = 72

    ===========================
    Unsuccessful ping of FWa to inside2 on FWb interface

    FWa # ping 10.52.100.10
    Send 5, echoes ICMP 100 bytes to 10.52.100.10, wait time is 2 seconds:
    Echo request ICMP from outside-interface to 10.52.100.10 ID = 19752 seq = 63173 len = 72
    ? Echo request ICMP from outside-interface to 10.52.100.10 ID = 19752 seq = 63173 len = 72
    ...

    FWb #.
    10.52.100.10 ID of S.S.S.S ICMP echo request = 19752 seq = 63173 len = 72
    10.52.100.10 ID of S.S.S.S ICMP echo request = 19752 seq = 63173 len = 72
    ....

    ==================================================================================

    Unsuccessful ping of Fwa to a host of related UI inside2 on FWb

    FWa # ping 10.52.100.1
    Type to abort escape sequence.
    Send 5, echoes ICMP 100 bytes to 10.52.100.1, wait time is 2 seconds:
    Echo request ICMP from outside-interface to 10.52.100.1 ID = 11842 seq = 15799 len = 72

    FWb #.
    Echo request ICMP outside:S.S.S.S to inside2:10.52.100.1 ID = 11842 seq = 15799 len = 72
    Echo request ICMP outside:S.S.S.S to inside2:10.52.100.1 ID = 11842 seq = 15799 len = 72

    =======================

    Thank you

    Hi odelaporte2,

    Is very probably the "access management" command is not applied in the second inside, only inside primary (see the race management) which will confirm.

    This command can be applied to an interface at a time, for example, if the law is now applied to the inside, it can not be applied to the inside2 at the same time.

    It may be useful

    -Randy-

  • The AnyConnect client software download

    Hello world

    I wonder to download all software connect to ASA 5520.

    Soon we are upgrading to anyconnect vpn client.

    We have users of windows 7 PC that will use the anyconnect VPN.

    Download cisco Web site I download these software for windows

    AnyConnect-EnableFIPS-win - 3.1.05152 - exe file.

    you will need to confirm if this is good software anyconnect?

    Web site has also

    AnyConnect-EnableFIPS-win - 3.1.05152.mst

    What is the difference between these 2?

    everything will work with windows 7 pc?

    Concerning

    MAhesh

    Mahesh,

    You must download the package file anyconnect-victory - 3.1.05152 - k9.pkg for the deployment of the SAA on the cisco site. It works perfectly with windows 7 PC.

Maybe you are looking for