Inside the interface of access IPSec on PIX

Similar Questions

• Not able to ping inside the interface from outside

  Hello

  I'm trying to stimulate a new network like the diagram of the topology below:

  Topology

  However, I have a problem:

  ASA:

  I can ping to:

  192.168.200.1 (Site_RTR IP, int fa0/1)

  192.168.200.2 (ASA vlan interface IP, outside interface)

  10.133.95.12 (DC_RTR, int fa0/1)

  10.133.200.1 (ASA vlan interface IP, inside the interface)

  10.133.200.23 (machine)

  The RTR website, I can do a ping to:

  10.133.95.12

  192.168.200.1

  192.168.200.2

  10.133.200.23 (machine)

  but not

  10.133.200.1 (ASA vlan interface IP, inside the interface)

  Question 1:

  It is possible to access / ping back to this address within the IP Interface from outside?

  Question 2:

  As all subnets 10.0.0.0/8 will go through the interface on the outside, however for the internet traffic, out thru interfacera outside 2.

  I haven't set up any nat, is correct to nat all out for outside2?

  NAT (inside outside2) source Dynamics one interface

  Configuration

  Thanks for the help.

  JJ

  Hi JJ,

  If you plan doing a ping within the IP address of the interface, while the traffic is coming from any interface other than inside, you won't able to ping inside the IP address of the interface.

  This is by design, and you cannot change it by any ACL or other settings.

  Thank you
  Ishan
  Please do not forget to select a correct answer and rate useful posts

• ASA 5540 - cannot ping inside the interface

  Hi all. We have recently upgraded PIX to ASA5540 and we saw a strange thing going. In a Word, we can ping the inside interface of the ASA from any beach on our 6500 network (which is connected directly behind the ASA on the inside), but one where our monitoring tools are placed. Inside there is an ACL that allows all of our core networks, but it does not help that the interface is really strange.

  In the ASDM, I see messages like this:

  ID ICMP echo request: 2004 x.x.x.x y.y.y.y on the inside interface to. I don't think that's the problem, but I could be wrong.

  This is also the configuration of the interface VLAN VIRTUAL local area network from which we cannot ping inside the interface we can ping to and since this VLAN and machines without problem. The only problem is ping the inside interface of the ASA.

  interface Vlanx

  IP x.x.x.x 255.255.255.0

  IP broadcast directed to 199

  IP accounting output-packets

  IP pim sparse - dense mode

  route IP cache flow

  load-interval 30

  Has anyone experiences the problem like this before? Thanks in advance for any help.

  Can you post the output of the following on the ASA:-

  display the route

  And the output of your base layer diverter: -.

  show ip route<>

  HTH >

• Cannot ping ASA inside the interface via VPN

  Hello

  I have a scenario with tunel VPN between a router and ASA and can ping subnet behind ASA subnet behind the router (and), but I cannot ping the ASA inside the interface on the VPN tunnel. I need to access the remote location ASDM. How can it be done?

  Thanks for your suggestions.

  Remi

  Hello

  You must have the 'inside access management' command configured on the SAA.

  If you run a 8.3 software or newer on the SAA, should also look at the configuration 'nat' IF the above command solves your problem

  -Jouni

• Can not handle the ASA inside the interface of Site to Site VPN

  Hi all

  I was deploying new site to site between ASA 8.0 (HQ) and ASA 8.4 (branch). Everything works fine but I have a problem on the ASA-reach remote that I can't manage branch ASA with inside the interface IP address.

  My setup on remote ASA

  management-access inside

  ICMP allow any inside

  SSH 0.0.0.0 0.0.0.0 inside

  SNMP-server host inside 10.0.1.101 communitry test-snmp version 2 c

  My Test

  -ping of the AC for inside the interface of remote ASA

  • Client time-out see demand
  • When debug icmp on ASA remote then ASA show only ICMP request to HQ no response back from remote ASA

  I'm not sure whether it's a bug on ASA 8.4 or not because I can manage a remote other ASA what version 8.0 software HQ

  Thanks in advance

  Do not know what 8.4 version you use, but it is broken in the 8.4 (2), I stumbled upon the upgrade from same problem. SSH and ASDM will not connect through a VPN L2L interface inside. This worked well in 8.4 (1).

  CSCtr16184

  http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtr16184

  [email protected] / * /.

• ASA - upgrade to 8.4, impossible to ping inside the interface via IPSec VPN

  We have configured a site 5, site to site VPN scenario.   Last week, we have upgraded 2 devices ASA 5505 to 8.4.2.   Before the upgrade, our monitoring software would ping the inside interface from remote devices to confirm VPN tunnels were established, as well as the addresses of remote devices and the outside of the ASA.   While we were on 8.2, remote equipment successfully ping the inside interface.   After that we went to 8.4.2 we can do a ping to this interface.   We looked at the newspapers and we see the ICMP traffic that is listed in the newspaper, but the remote equipment does not receive back icmp traffic.   We can ping successfully from local hardware interface inside and the external interface of remote devices successfully.  In addition, we can ping material behind the two devices in both directions successfully.

  We are unable to remotely manage the device through the VPN tunnel

  Net is:

  ASA #1 inside 10.168.107.1 (running ASA 8.2)

  ASA #2 inside 10.168.101.1 (running ASA 8,4)

  Server 1 (behind the ASA #1) 10.168.107.34

  Server 2 (behind the ASA #2) 10.168.101.14

  Can ping server 1 Server 2

  Can ping server 1 to 1 of the SAA

  Can ping server 2-ASA 2

  Can ping server 2 to server 1

  Can ping server 2 ASA 1

  Can ping ASA 2 ASA 1

  can not ping ASA 1 and 2 of the ASA

  can not ping server 1 and 2 of the ASA

  cannot access the ASA 2 https for management interface, nor can the ASDM software

  Here is the config on ASA (attached) 2.

  Any thoughts would be appreciated.

  Hey Joseph,.

  Most likely, you hit this bug:

  CSCtr16184            Details of bug

  To-the-box traffic switches vpn hosts after upgrade to 8.4.2.

  Symptom: After the upgrade of the ASA to 8.4.2 all management traffic to employment (including the) ICMP/telnet/ssh/ASDM) hosts via the VPN (L2L or remote access VPN) can fail the IP access address to the administration. Conditionsof : 1. the problem occurs if ASA is on 8.4.2. Not been seen on 8.4.1. 2. the user directly logged in the face of internal interfaces no problem with ICMP/telnet/ssh/AMPS in their respective interfaces. Workaround: The problem goes back to a Manual NAT statement that straddles the address IP-access to the administration. The NAT must have both the source areas and destination. Add the keyword "research route" at the end of the statement by NAT solves the problem. Ex: IP address access to the administration Interface of the ASA is 192.168.1.1. ! Statement by NAT overlapping: NAT obj destination - 192.168.1.0 obj - 192.168.1.0 Shared source (indoor, outdoor) VPN-vpn-obj static obj! New declaration: NAT obj destination - 192.168.1.0 obj - 192.168.1.0 Shared source (indoor, outdoor) public static obj - vpn vpn-obj-research route

  http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtr16184

  HTH,

  Raga

• {Possible bug} Parameters of the method inside the Interface method is misinterpreted by implemetor

  Steps to reproduce:

  1. my 4.6 version s FLash generator

  create the Interface:

  the package managers {}

  public interface ICommand {}

  public function get listener(): int;

  public function get params(): IMap;

  }

  }

  2.

  Implement the interface:

  the package managers {}

  public class order implements ICommand {}

  / / I'm not declaring the listener and params here, but code compiles the file and there is no redmarker errors is.

  public void Command (listenerParam:Function, params: IMap): Boolean {}

  This.Listener = listenerParam;

  This.params = params;

  }

  }

  }

  This cod eabove compiles without errors:

  fexfrmatter it's a waste.

  Never mind.

• Ping inside the interface on a Pix 501 from outside the network

  All the

  I have a Pix 501 firewall at a remote site with an IPSEC tunnel established at HQ. We have an analysis tool which remote sites for us let proactively pings know when a site crashes. I want to set up this ping the inside interface of the Pix tool as I can with 871 routers; However I can't configure the Pix to allow ICMP inside interface. I know by default that the Pix does not allow ICMP to the opposite interface and I was wondering if someone could help me with a configuration that will allow this? I enclose my configuration of the pix!

  Thank you

  Brian

  Hello

  By raising the ordering tool, it seems that the 'management-access' command was introduced in version 6.3

  I recommend spending at 6.3 If you can.

  Federico.

• Photoshop Script - layout of the interface user access within the variable?

  Hello

  I have the following variable as a layout of the user interface of a window, I have button access to the btn_one , but without success.

  var w = new Window("dialog {  \
      margins: 15, \
          btn_one: Button { \
              text: 'Button', \
              size: [100,25], \
              alignment:['right', 'center'] \
          }, \
      }");
  

  Any help to achieve this goal? I need to try the following, it does not work.

  btn_one.onClick = function(){
  }
  

  Thank you

  In your case, this may work:

  w.btn_one. OnClick();

  Not sure because I never build windows like that. I first create the window, then add the button on a separate line.

• Allow access to a single host separate interface on the inside of the interface

  I use a Cisco PIX 515E ASA 8.0 (3) - two separate networks, one on each interface running...

  I have a separate network interface 'Wireless' intentionally because I share wireless with my neighbor and don't want it on my LAN 'inside '. I sometimes want to use the wireless myself, but only need to access my printer to 192.168.21.6

  How can I access the interface 192.168.21.6 wireless (just tcp/udp port 9100 I think). I've experimented with static controls, but could not operate? I need to create a separate IP such as 192.168.22.6 and map that to 192.168.21.6 inside the interface to be able to print?

  static (inside, wireless) tcp 192.168.22.6 9100 192.168.21.6 9100 netmask 255.255.255.255

  ACL not already allow ALL IP traffic between areas (except the RISKY PORTS) so no need to change that to make this work.

  You can also make static identity in which wireless users can access the printer using its original address. But this will create problems with the neighbor :).

  Please rate if useful.

  Concerning

  Farrukh

• Cannot access the internal network of VPN with PIX 506th

  Hello

  I seem to have a problem with the configuration of my PIX. I ping the VPN client from the network in-house, but cannot cannot access all the resources of the vpn client. My running configuration is the following:

  Building configuration...

  : Saved

  :

  6.3 (5) PIX version

  interface ethernet0 car

  Auto interface ethernet1

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  activate the encrypted password of N/JZnmeC2l5j3YTN

  2KFQnbNIdI.2KYOU encrypted passwd

  hostname SwantonFw2

  domain name * *.com

  fixup protocol dns-length maximum 512

  fixup protocol ftp 21

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol http 80

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol sip 5060

  fixup protocol sip udp 5060

  fixup protocol 2000 skinny

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol tftp 69

  names of

  access-list outside_access_in allow icmp a whole

  allow_ping list access permit icmp any any echo response

  allow_ping list all permitted access all unreachable icmp

  access-list allow_ping allow icmp all once exceed

  the INSIDE-IN access list allow inside the interface tcp interface outside

  list access to the INSIDE-IN permit udp any any eq field

  list access to the INSIDE-IN permit tcp any any eq www

  list access to the INSIDE-IN permit tcp any any eq ftp

  list access to the INSIDE-IN permit icmp any any echo

  the INSIDE-IN permit tcp access list everything all https eq

  permit access ip 192.168.0.0 list inside_outbound_nat0_acl 255.255.255.0 192.168.240.0 255.255.255.0

  swanton_splitTunnelAcl ip access list allow a whole

  outside_cryptomap_dyn_20 ip access list allow any 192.168.240.0 255.255.255.0

  no pager

  Outside 1500 MTU

  Within 1500 MTU

  192.168.1.150 outside IP address 255.255.255.0

  IP address inside 192.168.0.35 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  IP pool local VPN_Pool 192.168.240.1 - 192.168.240.254

  location of PDM 0.0.0.0 255.255.255.0 outside

  location of PDM 192.168.1.26 255.255.255.255 outside

  location of PDM 192.168.240.0 255.255.255.0 outside

  PDM logging 100 information

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 0-list of access inside_outbound_nat0_acl

  NAT (inside) 1 192.168.0.0 255.255.255.0 0 0

  Access-group outside_access_in in interface outside

  group-access INTERIOR-IN in the interface inside

  Route outside 0.0.0.0 0.0.0.0 192.168.1.1 1

  Timeout xlate 0:05:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Sip timeout - disconnect 0:02:00 prompt Protocol sip-0: 03:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  AAA-server GANYMEDE + 3 max-failed-attempts

  AAA-server GANYMEDE + deadtime 10

  RADIUS Protocol RADIUS AAA server

  AAA-server RADIUS 3 max-failed-attempts

  AAA-RADIUS deadtime 10 Server

  AAA-server local LOCAL Protocol

  Enable http server

  http 192.168.0.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Permitted connection ipsec sysopt

  Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

  Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

  Dynamic crypto map outside_dyn_map 20 match address outside_cryptomap_dyn_20

  Crypto-map dynamic outside_dyn_map 20 the transform-set ESP-DES-MD5 value

  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

  client authentication card crypto outside_map LOCAL

  outside_map interface card crypto outside

  ISAKMP allows outside

  ISAKMP identity address

  part of pre authentication ISAKMP policy 20

  encryption of ISAKMP policy 20

  ISAKMP policy 20 md5 hash

  20 2 ISAKMP policy group

  ISAKMP duration strategy of life 20 86400

  Swanton vpngroup address pool VPN_Pool

  vpngroup swanton 192.168.1.1 dns server

  vpngroup swanton splitting swanton_splitTunnelAcl tunnel

  vpngroup idle 1800 swanton-time

  swanton vpngroup password *.

  Telnet timeout 5

  SSH timeout 5

  Console timeout 0

  dhcpd address 192.168.0.36 - 192.168.0.254 inside

  dhcpd dns 8.8.8.8 8.8.4.4

  dhcpd lease 3600

  dhcpd ping_timeout 750

  dhcpd outside auto_config

  dhcpd allow inside

  scott hwDnqhIenLiwIr9B of encrypted privilege 15 password username

  username password encrypted ET3skotcnISwb3MV privilege 2 norm

  username password tarmbrecht Zre8euXN6HxXaSdE encrypted privilege 2

  username, password jlillevik 9JMTvNZm3dLhQM/W encrypted privilege 2

  username privilege 15 encrypted password 49ikl05C8VE6k1jG ruralogic

  username bzeiter 1XjpdpkwnSENzfQ0 encrypted password privilege 2

  name of user mwalla encrypted password privilege 2 l5frk9obrNMGOiOD

  username heavyfab1 6.yy0ys7BifWsa9k encrypted password privilege 2

  username heavyfab3 6.yy0ys7BifWsa9k encrypted password privilege 2

  username heavyfab2 6.yy0ys7BifWsa9k encrypted password privilege 2

  username djet encrypted password privilege 2 wj13fSF4BPQzUzB8

  username, password cmorgan y/NeUfNKehh/Vzj6 encrypted privilege 2

  username password cmayfield Pe/felGx7VQ3I7ls encrypted privilege 2

  username privilege 2 encrypted password zQEQceRITRrO4wJa jeffg

  Terminal width 80

  Cryptochecksum:9005f35a85fa5fe31dab579bbb1428c8

  : end

  [OK]

  Any help will be greatly appreciated

  BJ,

  You try to access resources behind the inside interface network?

  IP address inside 192.168.0.35 255.255.255.0

  If so, please make the following changes:

  1 SWANTON_VPN_SPLIT permit access ip 192.168.0.0 list 255.255.255.0 192.168.240.0 255.255.255.0

  2-no vpngroup swanton splitting swanton_splitTunnelAcl tunnel

  Swanton vpngroup split tunnel SWANTON_VPN_SPLIT

  outside_cryptomap_dyn_20 3-no-list of ip access allowing any 192.168.240.0 255.255.255.0

  4 - isakmp nat-traversal 30

  Let me know how it goes.

  Portu.

  Please note all useful posts

• Refuse the selected inside address for internet access

  What is the best way to deny IP selected inside the addresses (PCs) access to the internet router in a PIX 506? Thank you

  Lori a

  Just use an ACL on your inside interface like so (this arretera.100 et.101 hosts out):

  > access-list out refuse host ip 192.168.1.100 everything

  > access-list out refuse host ip 192.168.1.101 everything

  > outgoing access-list allow ip 192.168.1.0 255.255.255.0 any

  > Access-group out in the interface inside

  In addition, you can change the following:

  > global (outside) 1 205.238.220.19 - 205.238.220.22

  > nat (inside) 1 0.0.0.0 0.0.0.0 0 0

  TO:

  > global (outside) 1 205.238.220.19 - 205.238.220.21

  > global (outside) 1 205.238.220.22

  > nat (inside) 1 0.0.0.0 0.0.0.0 0 0

  cause what you will allow only 4 outgoing sessions, only one user can use up to go to a web page. The second version will be PAT connections using the adresse.22, which will give you a 65 000 or if additional connections coming out.

• Œuvres of VPn on the inside of the interface, but not outside

  I have a PIX-525 with UR license.  I tried to get my VPN to work since my iphone over the weekend, but nothing helped.  Then, I changed the interface inside to see if my iMac could connect and bingo!  It worked.  I then tried to log in via the inside of the interface with my iphone and it worked.

  I have connected a PIX-515e and, using the same settings, can connect to the external interface via my iPhone.

  Strange.

  Now, to answer the pressing questions, yes I changed the IP address of the server in my client IPSEC settings to reflect the external and internal interfaces I was testing each of them.  I was using a pré-partagées secret.  Yes, the secret has been entered correctly and they have all matched... Yes, the name of the tunnel has been entered correctly.  I used the database local user for authentication with username/password name (i.e. no certificate of authorization to make things simpler for debugging).  I changed the syslog to debugging and I see absolutely no error when you try to connect my iphone to the external interface (i.e. turn off wifi so I'm on my 3G data network).  The only thing I see is where my iphone hits the external interface and it's disassembly (or whatever his name is) but that's all.

  Why this work like a charm with my PIX-515e and not my PIX-525?  VPN accelerator card in the 525 can be at fault?  The 515e doesn't have the aecellerator card.  No idea why can't I several a VPN connection inside the interface but not outside?

  Hi Tim,.

  Well it's not so much the DNS rewrite that is the problem (if you delete just the keyword dns VPN will still fail) but using the external interface for NAT. So all traffic intended for your address of the external interface is passed to the "gcbrouter", including vpn traffic.

  I'm thinking about a way to solve this problem, but I really can't find anythign right now. Using a different interface will not work because you can have only a single default route.

  I wonder if this would work:

  remove the NAT interface:

  not static (DMZ, external) gcbrouter netmask 255.255.255.255 dns interface

  Replace with PAT interface, i.e. add such a line for each port that you want to be contactable on the DMZ server:

  static interface tcp 80 gcbrouter 80 netmask 255.255.255.255 (DMZ, outside) dns

  static (DMZ, outside) of the 25 gcbrouter 25 netmask 255.255.255.255 tcp interface dns

  etc.

  In all honesty, I have never seen rewriting dns used with PAT so not quite sure if it will work.

  HTH

  Herbert

• I can't ping the interface inside of asa or telnet, when I came across the anyconnect vpn

  Hey Cisco net guys pro

  When I connect via anyconnect VPN to ASA 9.x, OS, I cannot ping inside
  the interface of asa or telnet, but I could ping at the interface of the router address
  ASA, the same two subnet

  Telnet 0.0.0.0 0.0.0.0 inside

  ICMP allow any insid

  Hi Ibrahim.

  Try 'inside access management' and let us know how it rates.

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages.

• ASA 5515 - Anyconnect - inside the subnet connection problem

  Hi all

  I have a problem with the connection to the Interior/subnet using Anyconnect SSL VPN.

  ASA worm. 5515

  Please find below of configuration:

  User access audit

  ASA1 # show running-config
  : Saved
  :
  ASA 9.1 Version 2
  !
  hostname ASA1
  activate 8Ry2YjIyt7RRXU24 encrypted password
  volatile xlate deny tcp any4 any4
  volatile xlate deny tcp any4 any6
  volatile xlate deny tcp any6 any4
  volatile xlate deny tcp any6 any6
  volatile xlate deny udp any4 any4 eq field
  volatile xlate deny udp any4 any6 eq field
  volatile xlate deny udp any6 any4 eq field
  volatile xlate deny udp any6 any6 eq field
  2KFQnbNIdI.2KYOU encrypted passwd
  names of
  mask of local pool swimming POOLS-for-AnyConnect 10.0.70.1 - 10.0.70.50 IP 255.255.255.0
  !
  interface GigabitEthernet0/0
  nameif outside
  security-level 0
  address IP A.A.A.A 255.255.255.240
  !
  interface GigabitEthernet0/1
  nameif inside
  security-level 100
  192.168.64.1 IP address 255.255.255.0
  !
  interface GigabitEthernet0/2
  nameif dmz
  security-level 20
  address IP B.B.B.B 255.255.255.0
  !
  interface GigabitEthernet0/3
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet0/4
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet0/5
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Management0/0
  management only
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  passive FTP mode
  network of the OBJ_GENERIC_ALL object
  subnet 0.0.0.0 0.0.0.0
  network outside_to_inside_FR-Appsrv01 object
  Home 192.168.64.232
  network outside_to_dmz_fr-websvr-uat object
  Home 10.20.20.14
  network inside_to_dmz object
  192.168.64.0 subnet 255.255.255.0
  gtc-tomcat network object
  Home 192.168.64.228
  network of the USA-Appsrv01-UAT object
  Home 192.168.64.223
  network of the USA-Websvr-UAT object
  Home 10.20.20.13
  network vpn_to_inside object
  10.0.70.0 subnet 255.255.255.0
  extended access list acl_out permit everything all unreachable icmp
  acl_out list extended access permit icmp any any echo response
  acl_out list extended access permit icmp any one time exceed
  acl_out list extended access permit tcp any object outside_to_inside_FR-Appsrv01 eq 3389
  acl_out list extended access permit tcp any object outside_to_inside_FR-Appsrv01 eq 28080
  acl_out list extended access permit tcp any object outside_to_inside_FR-Appsrv01 eq 9876
  acl_out list extended access permit udp any object outside_to_inside_FR-Appsrv01 eq 1720
  acl_out list extended access permit tcp any object outside_to_dmz_fr-websvr-uat eq www
  acl_out list extended access permit tcp any object outside_to_dmz_fr-websvr-uat eq https
  acl_out list extended access permit tcp any object outside_to_dmz_fr-websvr-uat eq 3389
  acl_out list extended access permit tcp any object USA-Appsrv01-UAT eq 9876
  acl_out list extended access permit udp any eq USA-Appsrv01-UAT object 1720
  acl_out list extended access permit tcp any object USA-Websvr-UAT eq www
  acl_out list extended access permit tcp any USA-Websvr-UAT eq https object
  acl_out list extended access permit tcp any object USA-Websvr-UAT eq 3389
  acl_out list extended access permit tcp any object USA-Appsrv01-UAT eq 3389
  acl_dmz list extended access permit icmp any any echo response
  acl_dmz of access allowed any ip an extended list
  acl_dmz list extended access permitted tcp object object to outside_to_dmz_fr-websvr-uat gtc-tomcat eq 8080
  acl_dmz list extended access permitted tcp object object to outside_to_dmz_fr-websvr-uat gtc-tomcat eq 8081
  acl_dmz list extended access permitted tcp object object to outside_to_dmz_fr-websvr-uat gtc-tomcat eq 3389
  acl_dmz list extended access permitted tcp object USA-Websvr-UAT object USA-Appsrv01-UAT eq 8080
  acl_dmz list extended access permitted tcp object USA-Websvr-UAT object USA-Appsrv01-UAT eq 8081
  access extensive list ip 192.168.64.0 gtcvpn2 allow 255.255.255.0 10.0.70.0 255.255.255.0
  pager lines 24
  Outside 1500 MTU
  Within 1500 MTU
  MTU 1500 dmz
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  don't allow no asdm history
  ARP timeout 14400
  no permit-nonconnected arp
  NAT dynamic interface of OBJ_GENERIC_ALL source (indoor, outdoor)
  NAT (inside, outside) static source all all static destination vpn_to_inside vpn_to_inside
  !
  network outside_to_inside_FR-Appsrv01 object
  NAT static x.x.x.x (indoor, outdoor)
  network outside_to_dmz_fr-websvr-uat object
  NAT (dmz, outside) static x.x.x.x
  network of the USA-Appsrv01-UAT object
  NAT static x.x.x.x (indoor, outdoor)
  network of the USA-Websvr-UAT object
  NAT (dmz, outside) static x.x.x.x
  Access-group acl_out in interface outside
  Access-group acl_dmz in dmz interface
  Route outside 0.0.0.0 0.0.0.0 B.B.B.B 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  dynamic-access-policy-registration DfltAccessPolicy
  identity of the user by default-domain LOCAL
  Enable http server
  http 192.168.64.204 255.255.255.255 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start
  Crypto ipsec pmtu aging infinite - the security association
  Crypto ca trustpoint ASDM_TrustPoint0
  registration auto
  name of the object CN = ASA1
  GTCVPN2 key pair
  Configure CRL
  trustpool crypto ca policy
  string encryption ca ASDM_TrustPoint0 certificates
  certificate of 19897d 54
  308201cf 30820138 a0030201 02020419 897d 864886f7 0d 010105 5430 0d06092a
  0500302c 3111300f 06035504 03130851 57455354 32343031 17301506 092a 8648
  09021608 51574553 54323430 31343132 30333034 30333237 301e170d 86f70d01
  5a170d32 34313133 30303430 3332375a 302 c 3111 55040313 08515745 300f0603
  53543234 30311730 1506092a 864886f7 010902 16085157 45535432 34303081 0d
  9f300d06 092 has 8648 86f70d01 01010500 03818d 00 30818902 818100a 2 5e873d21
  dfa7cc00 ee438d1d bc400dc5 220f2dc4 aa896be4 39843044 d0521010 88 has 24454
  b4b1f345 84ec0ad3 cac13d47 a71f367a 2e71f5fc 0a9bd55f 05d 75648 72bfb9e9
  c5379753 26ec523d f2cbc438 d234616f a71e4f4f 42f39dde e4b99020 cfcd00ad
  73162ab8 1af6b6f5 fa1b47c6 d261db8b 4a75b249 60556102 03010001 fa3fbe7c
  300 d 0609 2a 864886 f70d0101 8181007a 05050003 be791b64 a9f0df8f 982d162d
  b7c884c1 eb183711 05d676d7 2585486e 5cdd23b9 af774a8f 9623e91a b3d85f10
  af85c009 9590c0b3 401cec03 4dccf99a f1ee8c01 1e6f0f3a 6516579c 12d9cbab
  59fcead4 63baf64b 7adece49 7799f94c 1865ce1d 2c0f3ced e65fefdc a784dc50
  350e8ba2 998f3820 e6370ae5 7e6c543b 6c1ced
  quit smoking
  Telnet 192.168.64.200 255.255.255.255 inside
  Telnet 192.168.64.169 255.255.255.255 inside
  Telnet 192.168.64.190 255.255.255.255 inside
  Telnet 192.168.64.199 255.255.255.255 inside
  Telnet timeout 5
  SSH timeout 5
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  SSL-trust ASDM_TrustPoint0 inside point
  SSL-trust outside ASDM_TrustPoint0 point
  WebVPN
  allow outside
  AnyConnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
  AnyConnect enable
  tunnel-group-list activate
  internal GroupPolicy_GTCVPN2 group strategy
  attributes of Group Policy GroupPolicy_GTCVPN2
  WINS server no
  value of 192.168.64.202 DNS server 192.168.64.201
  client ssl-VPN-tunnel-Protocol
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list gtcvpn2
  field default value mondomaine.fr
  username cHoYQ5ZzE4HJyyq password of duncan / encrypted
  username Aosl50Zig4zLZm4 admin password / encrypted
  password encrypted sebol U7rG3kt653p8ctAz user name
  type tunnel-group GTCVPN2 remote access
  attributes global-tunnel-group GTCVPN2
  Swimming POOLS-for-AnyConnect address pool
  Group Policy - by default-GroupPolicy_GTCVPN2
  tunnel-group GTCVPN2 webvpn-attributes
  enable GTCVPN2 group-alias
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  Review the ip options
  inspect the netbios
  inspect the rsh
  inspect the rtsp
  inspect the skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect the tftp
  inspect the sip
  inspect xdmcp
  !
  global service-policy global_policy
  context of prompt hostname
  no remote anonymous reporting call
  call-home
  Profile of CiscoTAC-1
  no active account
  http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
  email address of destination [email protected] / * /
  destination-mode http transport
  Subscribe to alert-group diagnosis
  Subscribe to alert-group environment
  Subscribe to alert-group monthly periodic inventory 19
  Subscribe to alert-group configuration periodic monthly 19
  daily periodic subscribe to alert-group telemetry
  Cryptochecksum:0b972b3b751b59085bc2bbbb6b0c2281
  : end
  ASA1 #.

  I can connect to the ASA from outside with the Anyconnect client, split tunneling works well unfortunately I can't ping anything inside the network, VPN subnet: 255.255.255.0, inside the 192.168.64.x 255.255.255.0 subnet 10.0.70.x

  When connecting from the outside, cisco anyconnect is showing 192.168.64.0/24 in the tab "details of the trip.

  Do you know if I'm missing something? (internal subnet to subnet route vpn?)

  Thank you

  Use your internal subnet ASA as its default gateway? If this isn't the case, it will take a route pointing to the ASA inside the interface.

  You can perform a packet - trace as:

  Packet-trace entry inside tcp 192.168.64.2 80 10.0.70.1 1025

  (simulation of traffic back from a web server inside a VPN client)