AnyConnect 2.5 vs 3.1

Starting to upgrade our ASA 5505 devices (2).  Moving from asa844-k8.bin, asdm-649.bin, and anyconnect-win-2.5.3055-k9.pkg, to asa844-1-k8.bin, asdm-649-103.bin, and a new version of anyconnect-win.
I can't find any documentation on anyconnect-win-2.5.6005-k9.pkg vs anyconnect-win-3.1.00495-k9.pkg.  3.1 is almost 5 times larger (~5 MB vs ~29 MB).  I have scanned through the release notes for both versions.
Can someone please provide the pros and cons of using version 2.5 vs 3.1?
Thanks in advance,
Rick.

AnyConnect 3.1 is a significant upgrade, even over 3.0.
Over 3.0 it adds an enhanced GUI (common between Windows and Mac), NAM enhancement, crypto suite B enhancements, HostScan/Posture performance enhancements, IPv6 support, better untrusted certificate handling, plug-in component tiles, etc.
3.0+ offers IPSec VPN client as opposed to SSL VPN.

Similar Messages

  • AnyConnect to ASA 5505 ver 8.4 unable to ping/access Inside network

    My AnyConnect VPN connect to the ASA, however I cannot access my inside network hosts (tried Split Tunnel and it didn't work either). I plan to use a Split Tunnel configuration but I thought I would get this working before I implemented that configuration. My inside hosts are on a 10.0.1.0/24 network and 10.1.0.0/16 networks. My AnyConnect hosts are using 192.168.60.0/24 addresses.
    I have seen other people that appeared to have similar posts but none of those solutions have worked for me.  I have also tried several NAT and ACL configurations to allow traffic form my Inside network to the ANYConnect hosts and back, but apparently I did it incorrectly.  I undestand that this ver 8.4 is supposed to be easier to perform NAT and such, but I now in the router IOS it was much simpler.
    My configuration is included below.
    Thank you in advance for your assistance.
    Jerry
    ASA Version 8.4(4)
    hostname mxfw
    domain-name moxiefl.com
    enable password (removed)
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    shutdown
    interface Ethernet0/4
    shutdown
    interface Ethernet0/5
    switchport trunk allowed vlan 20,22
    switchport mode trunk
    interface Ethernet0/6
    shutdown
    interface Ethernet0/7
    shutdown
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Vlan20
    nameif dmz
    security-level 50
    ip address 172.26.20.1 255.255.255.0
    interface Vlan22
    nameif dmz2
    security-level 50
    ip address 172.26.22.1 255.255.255.0
    ftp mode passive
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server 208.67.222.222
    name-server 208.67.220.220
    domain-name moxiefl.com
    same-security-traffic permit inter-interface
    object network Generic_All_Network
    subnet 0.0.0.0 0.0.0.0
    object network INSIDE_Hosts
    subnet 10.1.0.0 255.255.0.0
    object network AnyConnect_Hosts
    subnet 192.168.60.0 255.255.255.0
    object network NETWORK_OBJ_192.168.60.0_26
    subnet 192.168.60.0 255.255.255.192
    object network DMZ_Network
    subnet 172.26.20.0 255.255.255.0
    object network DMZ2_Network
    subnet 172.26.22.0 255.255.255.0
    pager lines 24
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500
    mtu dmz2 1500
    ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic Generic_All_Network interface
    nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup
    nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.60.0_26 NETWORK_OBJ_192.168.60.0_26 no-proxy-arp route-lookup
    nat (dmz,outside) source dynamic Generic_All_Network interface
    nat (dmz2,outside) source dynamic Generic_All_Network interface
    route inside 10.1.0.0 255.255.0.0 10.0.1.2 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    http server enable
    http 10.0.0.0 255.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    fqdn anyconnect.moxiefl.com
    subject-name CN=AnyConnect.moxiefl.com
    keypair AnyConnect
    proxy-ldc-issuer
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 439a4452
        3082026c 308201d5 a0030201 02020443 9a445230 0d06092a 864886f7 0d010105
        05003048 311f301d 06035504 03131641 6e79436f 6e6e6563 742e6d6f 78696566
        6c2e636f 6d312530 2306092a 864886f7 0d010902 1616616e 79636f6e 6e656374
        2e6d6f78 6965666c 2e636f6d 301e170d 31333039 32373037 32353331 5a170d32
        33303932 35303732 3533315a 3048311f 301d0603 55040313 16416e79 436f6e6e
        6563742e 6d6f7869 65666c2e 636f6d31 25302306 092a8648 86f70d01 09021616
        616e7963 6f6e6e65 63742e6d 6f786965 666c2e63 6f6d3081 9f300d06 092a8648
        86f70d01 01010500 03818d00 30818902 8181009a d9f320ff e93d4fdd cb707a4c
        b4664c47 6d2cc639 4dc45fed bfbc2150 7109fd81 5d6a5252 3d40dc43 696360d5
        fbf92bcc 477d19b8 5301085c daf40de5 87d7e4aa f81b8d7f 8d364dfa 0a6f07d7
        6a7c3e9b 56e69152 aa5492d8 e35537bd 567ccf29 7afbeae8 13da9936 9f890d76
        1d56d11d da3d039a 0e714849 e6841ff2 5483b102 03010001 a3633061 300f0603
        551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06
        03551d23 04183016 80142f27 7096c4c5 e396e691 e07ef737 af61b71f 64f1301d
        0603551d 0e041604 142f2770 96c4c5e3 96e691e0 7ef737af 61b71f64 f1300d06
        092a8648 86f70d01 01050500 03818100 8f777196 bbe6a5e4 8af9eb9a 514a8348
        5e62d6cd 47257243 e430a758 2b367543 065d4ceb 582bf666 08ff7be1 f89287a2
        ac527824 b11c2048 7fd2b50d 35ca3902 6aa00675 e4df7859 f3590596 b1d52426
        1e97a52c 4e77f4b0 226dec09 713f7ba9 80bdf7bb b52a7da2 4a68b91b 455cabba
        0cc4c6f3 f244f7d9 0a6e32fb 31ce7e35
      quit
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    telnet timeout 5
    ssh 10.0.0.0 255.0.0.0 inside
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcpd dns 208.67.222.222 208.67.220.220
    dhcpd auto_config outside
    dhcpd address 10.0.1.20-10.0.1.40 inside
    dhcpd dns 208.67.222.222 208.67.220.220 interface inside
    dhcpd enable inside
    dhcpd address 172.26.20.21-172.26.20.60 dmz
    dhcpd dns 208.67.222.222 208.67.220.220 interface dmz
    dhcpd enable dmz
    dhcpd address 172.26.22.21-172.26.22.200 dmz2
    dhcpd dns 208.67.222.222 208.67.220.220 interface dmz2
    dhcpd enable dmz2
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    enable outside
    anyconnect-essentials
    anyconnect image disk0:/anyconnect-win-3.0.2052-k9.pkg 1
    anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy GroupPolicy_AnyConnect internal
    group-policy GroupPolicy_AnyConnect attributes
    wins-server none
    dns-server value 208.67.222.222 208.67.220.220
    vpn-tunnel-protocol ikev2 ssl-client
    default-domain value moxiefl.com
    webvpn
      anyconnect profiles value AnyConnect_client_profile type user
    username user1 password $$$$$$$$$$$$$$$$$ encrypted privilege 15
    username user2 password $$$$$$$$$$$$$$$$$ encrypted privilege 15
    tunnel-group AnyConnect type remote-access
    tunnel-group AnyConnect general-attributes
    address-pool VPN_POOL
    default-group-policy GroupPolicy_AnyConnect
    tunnel-group AnyConnect webvpn-attributes
    group-alias AnyConnect enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:f2c7362097b71bcada023c6bbfc45121
    : end

    Hi,
    Yes, I have saved the config and did a write erase and reloaded the config, no difference. I rebuilt it once a couple of weeks ago, but that was before I had gotten this far with your assistance.  I'll include my ASA and switches configs after this. Here is a little background (took it form the Firewall section issue just because it gives a little insight for the network). I have 2 3560s, one as a L3 switch the other L2 with an etherchannel between them (one of the cables was bad so I am waiting on the replacement to have 2 - Gigabit channels between the switches).
    I think our issue with the VPN not getting to the Inside is posibly related to my DMZ issue not getting to the internet.
    I am using 2 VLANs on my switch for Guests - one is wired and the other is wireless. I am trying to keep them separate because the wireless are any guest that might be at our restaurant that is getting on WiFi. The wired is for our Private Dining Rooms that vendors may need access and I don't want the wireless being able to see the wired network in that situation.
    I have ports on my 3560s that are assigned to VLAN 20 (Guest Wired) and VLAN 22 (Guest Wireless). I am not routing those addresses within the 3560s (one 3560 is setup as a L3 switch). Those VLANs are being L2 switched to the ASA via the trunk to save ports (I tried separating them and used 2 ports on the ASA and it still didn't work). The ASA is providing DCHP for those VLANs and the routing for the DMZ VLANs. I can ping each of the gateways (which are the VLANs on the ASA from devices on the 3560s - 172.26.20.1 and 172.26.22.1. I have those in my DMZ off the ASA so it can control and route the data.
    The 3560 is routing for my Corp VLANs. So far I have tested the Wired VLAN 10 (10.1.10.0/24) and it is working and gets to the Internet.  I have a default route (0.0.0.0 0.0.0.0) from the L3 switch to e0/1 on the ASA and e0/1 is an Inside interface.
    E0/0 on the ASA is my Outside interface and gets it IP from the upstream router (will be an AT&T router/modem when I move it to the building).
    So for a simple diagram:
    PC (172.26.20.21/24) -----3560 (L2) ------Trunk----(VLAN 20 - DMZ/ VLAN 22 - DMZ2)---- ASA -----Outside ------- Internet (via router/modem)
    I will be back at this tomorrow morning - I've been up since 4pm yesterday and it is almost 3pm.
    Thank you for all of your assistance.
    Jerry
    Current ASA Config:
    ASA Version 8.4(4)
    hostname mxfw
    domain-name moxiefl.com
    enable password $$$$$$$$$$$$$$$ encrypted
    passwd $$$$$$$$$$$$$$$$ encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    shutdown
    interface Ethernet0/4
    switchport access vlan 20
    interface Ethernet0/5
    switchport trunk allowed vlan 20,22
    switchport mode trunk
    interface Ethernet0/6
    shutdown
    interface Ethernet0/7
    shutdown
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.0.1.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface Vlan20
    nameif dmz
    security-level 50
    ip address 172.26.20.1 255.255.255.0
    interface Vlan22
    nameif dmz2
    security-level 50
    ip address 172.26.22.1 255.255.255.0
    ftp mode passive
    dns domain-lookup inside
    dns domain-lookup outside
    dns server-group DefaultDNS
    name-server 208.67.222.222
    name-server 208.67.220.220
    domain-name moxiefl.com
    same-security-traffic permit inter-interface
    object network Generic_All_Network
    subnet 0.0.0.0 0.0.0.0
    object network INSIDE_Hosts
    subnet 10.1.0.0 255.255.0.0
    object network AnyConnect_Hosts
    subnet 192.168.60.0 255.255.255.0
    object network NETWORK_OBJ_192.168.60.0_26
    subnet 192.168.60.0 255.255.255.192
    object network DMZ_Network
    subnet 172.26.20.0 255.255.255.0
    object network DMZ2_Network
    subnet 172.26.22.0 255.255.255.0
    object network INSIDE
    subnet 10.0.1.0 255.255.255.0
    access-list capdmz extended permit icmp host 172.26.20.22 host 208.67.222.222
    access-list capdmz extended permit icmp host 208.67.222.222 host 172.26.20.22
    access-list capout extended permit icmp host 192.168.1.231 host 208.67.222.222
    access-list capout extended permit icmp host 208.67.222.222 host 192.168.1.231
    access-list capvpn extended permit icmp host 192.168.60.20 host 10.1.10.23
    access-list capvpn extended permit icmp host 10.1.10.23 host 192.168.60.20
    access-list AnyConnect_Client_Local_Print extended deny ip any any
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns
    access-list SPLIT-TUNNEL standard permit 10.0.1.0 255.255.255.0
    access-list SPLIT-TUNNEL standard permit 10.1.0.0 255.255.0.0
    access-list capins extended permit icmp host 10.1.10.23 host 10.0.1.1
    access-list capins extended permit icmp host 10.0.1.1 host 10.1.10.23
    pager lines 24
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500
    mtu dmz2 1500
    ip local pool VPN_POOL 192.168.60.20-192.168.60.40 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source static INSIDE INSIDE destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup
    nat (inside,outside) source static INSIDE_Hosts INSIDE_Hosts destination static AnyConnect_Hosts AnyConnect_Hosts route-lookup
    nat (dmz,outside) source dynamic Generic_All_Network interface
    nat (dmz2,outside) source dynamic Generic_All_Network interface
    nat (inside,outside) after-auto source dynamic Generic_All_Network interface
    route inside 10.1.0.0 255.255.0.0 10.0.1.2 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    http server enable
    http 10.0.0.0 255.0.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev2 ipsec-proposal AES256
    protocol esp encryption aes-256
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
    protocol esp encryption aes-192
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
    protocol esp encryption aes
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
    protocol esp encryption 3des
    protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal DES
    protocol esp encryption des
    protocol esp integrity sha-1 md5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment self
    fqdn anyconnect.moxiefl.com
    subject-name CN=AnyConnect.moxiefl.com
    keypair AnyConnect
    proxy-ldc-issuer
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 439a4452
        3082026c 308201d5 a0030201 02020443 9a445230 0d06092a 864886f7 0d010105
        05003048 311f301d 06035504 03131641 6e79436f 6e6e6563 742e6d6f 78696566
        6c2e636f 6d312530 2306092a 864886f7 0d010902 1616616e 79636f6e 6e656374
        2e6d6f78 6965666c 2e636f6d 301e170d 31333039 32373037 32353331 5a170d32
        33303932 35303732 3533315a 3048311f 301d0603 55040313 16416e79 436f6e6e
        6563742e 6d6f7869 65666c2e 636f6d31 25302306 092a8648 86f70d01 09021616
        616e7963 6f6e6e65 63742e6d 6f786965 666c2e63 6f6d3081 9f300d06 092a8648
        86f70d01 01010500 03818d00 30818902 8181009a d9f320ff e93d4fdd cb707a4c
        b4664c47 6d2cc639 4dc45fed bfbc2150 7109fd81 5d6a5252 3d40dc43 696360d5
        fbf92bcc 477d19b8 5301085c daf40de5 87d7e4aa f81b8d7f 8d364dfa 0a6f07d7
        6a7c3e9b 56e69152 aa5492d8 e35537bd 567ccf29 7afbeae8 13da9936 9f890d76
        1d56d11d da3d039a 0e714849 e6841ff2 5483b102 03010001 a3633061 300f0603
        551d1301 01ff0405 30030101 ff300e06 03551d0f 0101ff04 04030201 86301f06
        03551d23 04183016 80142f27 7096c4c5 e396e691 e07ef737 af61b71f 64f1301d
        0603551d 0e041604 142f2770 96c4c5e3 96e691e0 7ef737af 61b71f64 f1300d06
        092a8648 86f70d01 01050500 03818100 8f777196 bbe6a5e4 8af9eb9a 514a8348
        5e62d6cd 47257243 e430a758 2b367543 065d4ceb 582bf666 08ff7be1 f89287a2
        ac527824 b11c2048 7fd2b50d 35ca3902 6aa00675 e4df7859 f3590596 b1d52426
        1e97a52c 4e77f4b0 226dec09 713f7ba9 80bdf7bb b52a7da2 4a68b91b 455cabba
        0cc4c6f3 f244f7d9 0a6e32fb 31ce7e35
      quit
    crypto ikev2 policy 1
    encryption aes-256
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 10
    encryption aes-192
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 20
    encryption aes
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 30
    encryption 3des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 policy 40
    encryption des
    integrity sha
    group 5 2
    prf sha
    lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
    telnet timeout 5
    ssh 10.0.0.0 255.0.0.0 inside
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcpd dns 208.67.222.222 208.67.220.220
    dhcpd auto_config outside
    dhcpd address 10.0.1.20-10.0.1.40 inside
    dhcpd dns 208.67.222.222 208.67.220.220 interface inside
    dhcpd enable inside
    dhcpd address 172.26.20.21-172.26.20.60 dmz
    dhcpd dns 208.67.222.222 208.67.220.220 interface dmz
    dhcpd enable dmz
    dhcpd address 172.26.22.21-172.26.22.200 dmz2
    dhcpd dns 208.67.222.222 208.67.220.220 interface dmz2
    dhcpd enable dmz2
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    enable outside
    anyconnect-essentials
    anyconnect image disk0:/anyconnect-win-3.0.2052-k9.pkg 1
    anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml
    anyconnect enable
    tunnel-group-list enable
    group-policy GroupPolicy_AnyConnect internal
    group-policy GroupPolicy_AnyConnect attributes
    wins-server none
    dns-server value 208.67.222.222 208.67.220.220
    vpn-tunnel-protocol ikev2 ssl-client
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value SPLIT-TUNNEL
    default-domain value moxiefl.com
    webvpn
      anyconnect profiles value AnyConnect_client_profile type user
    username user1 password $$$$$$$$$$$$$ encrypted privilege 15
    username user2 password $$$$$$$$$$$ encrypted privilege 15
    tunnel-group AnyConnect type remote-access
    tunnel-group AnyConnect general-attributes
    address-pool VPN_POOL
    default-group-policy GroupPolicy_AnyConnect
    tunnel-group AnyConnect webvpn-attributes
    group-alias AnyConnect enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:f6d9bbacca2a5c8b5af946a8ddc12550
    : end
    L3 3560 connects to ASA via port f0/3 routed port 10.0.1.0/24 network
    Connects to second 3560 via G0/3 & G0/4
    version 12.2
    no service pad
    no service timestamps debug uptime
    no service timestamps log uptime
    service password-encryption
    hostname mx3560a
    boot-start-marker
    boot-end-marker
    enable secret 5 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    no aaa new-model
    system mtu routing 1500
    authentication mac-move permit
    ip subnet-zero
    ip routing
    ip dhcp excluded-address 10.1.10.1 10.1.10.20
    ip dhcp excluded-address 10.1.12.1 10.1.12.20
    ip dhcp excluded-address 10.1.14.1 10.1.14.20
    ip dhcp excluded-address 10.1.16.1 10.1.16.20
    ip dhcp excluded-address 10.1.30.1 10.1.30.20
    ip dhcp excluded-address 10.1.35.1 10.1.35.20
    ip dhcp excluded-address 10.1.50.1 10.1.50.20
    ip dhcp excluded-address 10.1.80.1 10.1.80.20
    ip dhcp excluded-address 10.1.90.1 10.1.90.20
    ip dhcp excluded-address 10.1.100.1 10.1.100.20
    ip dhcp excluded-address 10.1.101.1 10.1.101.20
    ip dhcp pool VLAN10
       network 10.1.10.0 255.255.255.0
       default-router 10.1.10.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN12
       network 10.1.12.0 255.255.255.0
       default-router 10.1.12.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN14
       network 10.1.14.0 255.255.255.0
       default-router 10.1.14.1
       option 150 ip 10.1.13.1
    ip dhcp pool VLAN16
       network 10.1.16.0 255.255.255.0
       default-router 10.1.16.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN30
       network 10.1.30.0 255.255.255.0
       default-router 10.1.30.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN35
       network 10.1.35.0 255.255.255.0
       default-router 10.1.35.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN50
       network 10.1.50.0 255.255.255.0
       default-router 10.1.50.1
       option 43 hex f104.0a01.6564
    ip dhcp pool VLAN80
       network 10.1.80.0 255.255.255.0
       default-router 10.1.80.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN90
       network 10.1.90.0 255.255.255.0
       default-router 10.1.90.1
       dns-server 208.67.222.222 208.67.220.220
    ip dhcp pool VLAN100
       network 10.1.100.0 255.255.255.0
       default-router 10.1.100.1
    ip dhcp pool VLAN101
       network 10.1.101.0 255.255.255.0
       default-router 10.1.101.1
    ip dhcp pool VLAN40
       dns-server 208.67.222.222 208.67.220.220
    port-channel load-balance src-dst-mac
    spanning-tree mode pvst
    spanning-tree etherchannel guard misconfig
    spanning-tree extend system-id
    vlan internal allocation policy ascending
    interface Port-channel1
    switchport trunk encapsulation dot1q
    switchport mode trunk
    link state group 1 downstream
    interface FastEthernet0/1
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 100
    switchport mode trunk
    power inline never
    interface FastEthernet0/2
    switchport access vlan 10
    switchport mode access
    power inline never
    interface FastEthernet0/3
    description Interface to MXFW E0/1
    no switchport
    ip address 10.0.1.2 255.255.255.0
    power inline never
    interface FastEthernet0/4
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/5
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/6
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/7
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 30
    switchport mode trunk
    switchport voice vlan 14
    power inline never
    spanning-tree portfast
    interface FastEthernet0/8
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/9
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/10
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/11
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/12
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/13
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/14
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/15
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/16
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/17
    switchport access vlan 50
    switchport mode access
    interface FastEthernet0/18
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/19
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/20
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 10
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/21
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/22
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/23
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 30
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/24
    switchport access vlan 35
    switchport mode access
    power inline never
    interface FastEthernet0/25
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/26
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/27
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/28
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/29
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/30
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/31
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/32
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/33
    switchport access vlan 50
    switchport mode access
    interface FastEthernet0/34
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/35
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/36
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 10
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/37
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/38
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/39
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/40
    switchport access vlan 90
    switchport mode access
    power inline never
    interface FastEthernet0/41
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/42
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/43
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/44
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/45
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/46
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/47
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/48
    switchport mode access
    shutdown
    power inline never
    interface GigabitEthernet0/1
    description Interface to MXC2911 Port G0/0
    no switchport
    ip address 10.1.13.2 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    interface GigabitEthernet0/3
    switchport trunk encapsulation dot1q
    switchport mode trunk
    channel-group 1 mode on
    interface GigabitEthernet0/4
    switchport trunk encapsulation dot1q
    switchport mode trunk
    channel-group 1 mode on
    interface Vlan1
    no ip address
    shutdown
    interface Vlan10
    ip address 10.1.10.1 255.255.255.0
    interface Vlan12
    ip address 10.1.12.1 255.255.255.0
    interface Vlan14
    ip address 10.1.14.1 255.255.255.0
    interface Vlan16
    ip address 10.1.16.1 255.255.255.0
    interface Vlan20
    ip address 172.26.20.1 255.255.255.0
    interface Vlan22
    ip address 172.26.22.1 255.255.255.0
    interface Vlan30
    ip address 10.1.30.1 255.255.255.0
    interface Vlan35
    ip address 10.1.35.1 255.255.255.0
    interface Vlan40
    ip address 10.1.40.1 255.255.255.0
    interface Vlan50
    ip address 10.1.50.1 255.255.255.0
    interface Vlan80
    ip address 172.16.80.1 255.255.255.0
    interface Vlan86
    no ip address
    shutdown
    interface Vlan90
    ip address 10.1.90.1 255.255.255.0
    interface Vlan100
    ip address 10.1.100.1 255.255.255.0
    interface Vlan101
    ip address 10.1.101.1 255.255.255.0
    router eigrp 1
    network 10.0.0.0
    network 10.1.13.0 0.0.0.255
    network 10.1.14.0 0.0.0.255
    passive-interface default
    no passive-interface GigabitEthernet0/1
    ip classless
    ip route 0.0.0.0 0.0.0.0 FastEthernet0/3 10.0.1.1
    ip route 192.168.60.0 255.255.255.0 FastEthernet0/3 10.0.1.1 2
    ip http server
    ip sla enable reaction-alerts
    line con 0
    logging synchronous
    line vty 0 4
    login
    line vty 5 15
    login
    end
    L3 3560 Route Table (I added 192.168.60.0/24 instead of just using the default route just in case it wasn't routing for some reason - no change)
    mx3560a#sho ip route
    Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
           D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2
           i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
           ia - IS-IS inter area, * - candidate default, U - per-user static route
           o - ODR, P - periodic downloaded static route
    Gateway of last resort is 10.0.1.1 to network 0.0.0.0
    S    192.168.60.0/24 [2/0] via 10.0.1.1, FastEthernet0/3
         172.16.0.0/24 is subnetted, 1 subnets
    C       172.16.80.0 is directly connected, Vlan80
         172.26.0.0/24 is subnetted, 2 subnets
    C       172.26.22.0 is directly connected, Vlan22
    C       172.26.20.0 is directly connected, Vlan20
         10.0.0.0/8 is variably subnetted, 14 subnets, 2 masks
    C       10.1.10.0/24 is directly connected, Vlan10
    D       10.1.13.5/32 [90/3072] via 10.1.13.1, 4d02h, GigabitEthernet0/1
    C       10.1.14.0/24 is directly connected, Vlan14
    C       10.1.13.0/24 is directly connected, GigabitEthernet0/1
    C       10.1.12.0/24 is directly connected, Vlan12
    C       10.0.1.0/24 is directly connected, FastEthernet0/3
    C       10.1.30.0/24 is directly connected, Vlan30
    C       10.1.16.0/24 is directly connected, Vlan16
    C       10.1.40.0/24 is directly connected, Vlan40
    C       10.1.35.0/24 is directly connected, Vlan35
    C       10.1.50.0/24 is directly connected, Vlan50
    C       10.1.90.0/24 is directly connected, Vlan90
    C       10.1.101.0/24 is directly connected, Vlan101
    C       10.1.100.0/24 is directly connected, Vlan100
    S*   0.0.0.0/0 [1/0] via 10.0.1.1, FastEthernet0/3
    I have a C2911 for CME on G0/1 - using it only for that purpose at this time.
    L2 3560 Config it connects to the ASA as a trunk on e0/5 of the ASA and port f0/3 of the switch - I am using L2 switching for the DMZ networks from the switches to the ASA and allowing the ASA to provide the DHCP and routing out of the network. DMZ networks: 172.26.20.0/24 and 172.26.22.0/24.
    version 12.2
    no service pad
    no service timestamps debug uptime
    no service timestamps log uptime
    service password-encryption
    hostname mx3560b
    boot-start-marker
    boot-end-marker
    enable secret 5 $$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
    no aaa new-model
    system mtu routing 1500
    crypto pki trustpoint TP-self-signed-3877365632
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-3877365632
    revocation-check none
    rsakeypair TP-self-signed-3877365632
    crypto pki certificate chain TP-self-signed-3877365632
    certificate self-signed 01
      30820240 308201A9 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 33383737 33363536 3332301E 170D3933 30333031 30303031
      30395A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 38373733
      36353633 3230819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100DF81 DA515E0B 7FC760CF 2CC98400 42DCA007 215E4DDE D0C3FBF2 D974CE85
      C46A8700 6AE44C2C 79D9BD2A A9297FA0 2D9C2BE4 B3941A2F 435AC4EA 17E89DFE
      34EC8E93 63BD4CDF 784E91D7 2EE0093F 06CC97FD 83CB818B 1ED624E6 F0F5DA51
      1DE4B8A7 169EED2B 40575B81 BADDE052 85BA9D19 4C206DCB 00878FF3 89E74028
      B3F30203 010001A3 68306630 0F060355 1D130101 FF040530 030101FF 30130603
      551D1104 0C300A82 086D7833 35363062 2E301F06 03551D23 04183016 80147125
      78CE8540 DB95D852 3C0BD975 5D9C6EB7 58FC301D 0603551D 0E041604 14712578
      CE8540DB 95D8523C 0BD9755D 9C6EB758 FC300D06 092A8648 86F70D01 01040500
      03818100 94B98410 2D9CD602 4BD16181 BCB7C515 77C8F947 7C4AF5B8 281E3131
      59298655 B12FAB1D A6AAA958 8473483C E993D896 5251770B 557803C0 531DEB62
      A349C057 CB473F86 DCEBF8B8 7DDE5728 048A49D0 AB18CE8C 8257C00A C2E06A63
      B91F872C 5F169FF9 77DC523B AB1E3965 C6B67FCC 84AE11E9 02DD10F0 C45EAFEA 41D7FA6C
      quit
    port-channel load-balance src-dst-mac
    spanning-tree mode pvst
    spanning-tree extend system-id
    vlan internal allocation policy ascending
    interface Port-channel1
    switchport trunk encapsulation dot1q
    switchport mode trunk
    interface FastEthernet0/1
    switchport access vlan 50
    switchport mode access
    interface FastEthernet0/2
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/3
    switchport trunk encapsulation dot1q
    switchport trunk allowed vlan 20,22
    switchport mode trunk
    power inline never
    interface FastEthernet0/4
    switchport mode access
    shutdown
    power inline never
    interface FastEthernet0/5
    shutdown
    power inline never
    interface FastEthernet0/6
    shutdown
    power inline never
    interface FastEthernet0/7
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 30
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/8
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/9
    shutdown
    power inline never
    interface FastEthernet0/10
    switchport access vlan 20
    switchport mode access
    power inline never
    interface FastEthernet0/11
    shutdown
    power inline never
    interface FastEthernet0/12
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/13
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/14
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/15
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/16
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/17
    switchport access vlan 10
    switchport mode access
    power inline never
    interface FastEthernet0/18
    shutdown
    power inline never
    interface FastEthernet0/19
    shutdown
    power inline never
    interface FastEthernet0/20
    switchport trunk encapsulation dot1q
    switchport trunk native vlan 10
    switchport mode trunk
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/21
    shutdown
    power inline never
    interface FastEthernet0/22
    shutdown
    power inline never
    interface FastEthernet0/23
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/24
    shutdown
    power inline never
    interface FastEthernet0/25
    switchport access vlan 20
    switchport mode access
    power inline never
    interface FastEthernet0/26
    shutdown
    power inline never
    interface FastEthernet0/27
    shutdown
    power inline never
    interface FastEthernet0/28
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/29
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/30
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/31
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/32
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/33
    switchport access vlan 20
    switchport mode access
    power inline never
    interface FastEthernet0/34
    shutdown
    power inline never
    interface FastEthernet0/35
    shutdown
    power inline never
    interface FastEthernet0/36
    switchport mode access
    switchport voice vlan 14
    spanning-tree portfast
    interface FastEthernet0/37
    shutdown
    power inline never
    interface FastEthernet0/38
    shutdown
    power inline never
    interface FastEthernet0/39
    switchport access vlan 30
    switchport mode access
    power inline never
    interface FastEthernet0/40
    switchport access vlan 90
    switchport mode access
    power inline never
    interface FastEthernet0/41
    shutdown
    power inline never
    interface FastEthernet0/42
    shutdown
    power inline never
    interface FastEthernet0/43
    shutdown
    power inline never
    interface FastEthernet0/44
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/45
    switchport access vlan 40
    switchport mode access
    interface FastEthernet0/46
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/47
    switchport access vlan 40
    switchport mode access
    shutdown
    interface FastEthernet0/48
    switchport access vlan 40
    switchport mode access
    shutdown
    interface GigabitEthernet0/1
    shutdown
    interface GigabitEthernet0/2
    switchport access vlan 40
    switchport mode access
    interface GigabitEthernet0/3
    switchport trunk encapsulation dot1q
    switchport mode trunk
    channel-group 1 mode on
    interface GigabitEthernet0/4
    switchport trunk encapsulation dot1q
    switchport mode trunk
    channel-group 1 mode on
    interface Vlan1
    no ip address
    ip classless
    ip http server
    ip http secure-server
    ip sla enable reaction-alerts
    line con 0
    logging synchronous
    line vty 0 4
    login
    line vty 5 15
    login
    end

  • ASA5520 AnyConnect SSL VPN Connected but unable to ping my inside LAN

    Hi there, please forgive if I have missed any forum protocols as this is my first post.
    I am trying to configure Anyconnect SSL VPN. I am able to connect to the VPN on a laptop, witch is able to download the anyconnect client from the ASA. I am unable to ping any of my IP's that are on the inside of my ASA. Before posting here I have spent many hours on forums and watching videos on anyconnect SSL VPN creation and I am following it to the T but still no ping. Any help would be very much appreciated.
    Inside              192.168.1.254/24
    Outside           dhcp
    VPN Pool        192.168.250.1-50/24
    Inside LAN     192.168.1.0/24
    : Saved
    ASA Version 8.4(4)1
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface GigabitEthernet0/1
    nameif inside
    security-level 99
    ip address 192.168.1.254 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 99
    ip address 192.168.100.1 255.255.255.0
    ftp mode passive
    dns server-group DefaultDNS
    domain-name dock.local
    same-security-traffic permit inter-interface
    object network inside-network-object
    subnet 192.168.1.0 255.255.255.0
    object network management-network-object
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.250.0_25
    subnet 192.168.250.0 255.255.255.128
    object-group network AllInside-networks
    network-object object inside-network-object
    network-object object management-network-object
    access-list inside_access_in extended permit ip any any
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list split_tunnel standard permit 192.168.1.0 255.255.255.0
    access-list split_tunnel standard permit 192.168.100.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu management 1500
    ip local pool vpn_pool 192.168.250.1-192.168.250.100 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-647.bin
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic AllInside-networks interface
    nat (inside,any) source static any any destination static NETWORK_OBJ_192.168.250.0_25 NETWORK_OBJ_192.168.250.0_25 no-proxy-arp route-lookup
    access-group outside_access_in in interface outside
    access-group inside_access_in in interface inside
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable 4433
    http 192.168.100.0 255.255.255.0 management
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    telnet timeout 5
    ssh 192.168.1.0 255.255.255.0 inside
    ssh 192.168.100.0 255.255.255.0 management
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1
    webvpn
    enable outside
    anyconnect image disk0:/anyconnect-win-3.1.03103-k9.pkg 1
    anyconnect enable
    tunnel-group-list enable
    group-policy GroupPolicy_anyconnect internal
    group-policy GroupPolicy_anyconnect attributes
    wins-server none
    dns-server value 8.8.8.8
    vpn-tunnel-protocol ssl-client ssl-clientless
    split-tunnel-policy tunnelall
    split-tunnel-network-list value split_tunnel
    default-domain value dock.local
    username test password JAasdf434ey521ZCT encrypted privilege 15
    tunnel-group anyconnect type remote-access
    tunnel-group anyconnect general-attributes
    address-pool vpn_pool
    default-group-policy GroupPolicy_anyconnect
    tunnel-group anyconnect webvpn-attributes
    group-alias anyconnect enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http
    https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email
    [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:24bcba3c4124ab371297d52260135924
    : end :

    : Saved
    ASA Version 8.4(4)1
    interface GigabitEthernet0/0
    nameif outside
    security-level 0
    ip address dhcp setroute
    interface GigabitEthernet0/1
    nameif inside
    security-level 99
    ip address 192.168.1.254 255.255.255.0
    interface GigabitEthernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    nameif management
    security-level 99
    ip address 192.168.100.1 255.255.255.0
    ftp mode passive
    dns server-group DefaultDNS
    domain-name dock.local
    same-security-traffic permit inter-interface
    object network inside-network-object
    subnet 192.168.1.0 255.255.255.0
    object network management-network-object
    subnet 192.168.100.0 255.255.255.0
    object network NETWORK_OBJ_192.168.250.0_25
    subnet 192.168.250.0 255.255.255.0
    object-group network AllInside-networks
    network-object object inside-network-object
    network-object object management-network-object
    access-list inside_access_in extended permit ip any any
    access-list outside_access_in extended permit icmp any any echo-reply
    access-list split_tunnel standard permit 192.168.1.0 255.255.255.0
    access-list split_tunnel standard permit 192.168.100.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu management 1500
    ip local pool Anyconnect-pool 192.168.250.1-192.168.250.100 mask 255.255.255.0
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-647.bin
    no asdm history enable
    arp timeout 14400
    nat (inside,outside) source dynamic AllInside-networks interface
    nat (inside,outside) source static inside-network-object inside-network-object destination static NETWORK_OBJ_192.168.250.0_25 NETWORK_OBJ_192.168.250.0_25
    nat (inside,outside) source static management-network-object management-network-object destination static NETWORK_OBJ_192.168.250.0_25 NETWORK_OBJ_192.168.250.0_25
    access-group outside_access_in in interface outside
    access-group inside_access_in in interface inside
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 192.168.100.2 255.255.255.255 management
    http 192.168.100.0 255.255.255.0 management
    http 192.168.1.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    telnet timeout 5
    ssh 192.168.1.0 255.255.255.0 inside
    ssh 192.168.100.0 255.255.255.0 management
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    management-access inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1
    webvpn
    enable outside
    anyconnect image disk0:/anyconnect-win-3.1.03103-k9.pkg 1
    anyconnect enable
    tunnel-group-list enable
    group-policy GroupPolicy_Anyconnect_VPN internal
    group-policy GroupPolicy_Anyconnect_VPN attributes
    wins-server none
    dns-server value 8.8.8.8
    vpn-tunnel-protocol ssl-client
    split-tunnel-policy tunnelall
    split-tunnel-network-list value split_tunnel
    default-domain value dock.local
    username sander password f/J.5nLef/EqyPfy encrypted
    username aveha password JA8X3IiqPvFFsZCT encrypted privilege 15
    tunnel-group Anyconnect_VPN type remote-access
    tunnel-group Anyconnect_VPN general-attributes
    address-pool Anyconnect-pool
    default-group-policy GroupPolicy_Anyconnect_VPN
    tunnel-group Anyconnect_VPN webvpn-attributes
    group-alias Anyconnect_VPN enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http
    https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email
    [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:4636fa566ffc11b0f7858b760d974dee
    : end:

  • Lots of Anyconnect Error Message in Windows Event Log

    Hi Community.
    We have lots of Anyconnect Error Messages in the Windows Event Log. Following two examples.
    Can anyone tell me why these errors appears and how do I fix them ? I already installed the newest Anyconnect on my machine.
    Thanks in advance and Kind Regards Patrick
    Example 1
      <Provider Name="acvpnagent" />
      <EventID Qualifiers="9216">2</EventID>
      <Keywords>0x80000000000000</Keywords>
      <EventRecordID>97564</EventRecordID>
      <Channel>Cisco AnyConnect Secure Mobility Client</Channel>
    - <EventData>
      <Data>Function: CNetEnvironment::logProbeFailure File: .\NetEnvironment.cpp Line: 1432 Invoked Function: CHttpProbeAsync::SendProbe Return Code: -27066354 (0xFE63000E) Description: HTTP_PROBE_ASYNC_ERROR_CANNOT_CONNECT HTTP (host: 109.164.211.237)</Data>
      </EventData>
    Example 2
      <Provider Name="acvpnagent" />
      <EventID Qualifiers="9216">2</EventID>
      <Keywords>0x80000000000000</Keywords>
      <EventRecordID>97565</EventRecordID>
      <Channel>Cisco AnyConnect Secure Mobility Client</Channel>
    - <EventData>
      <Data>Function: CNetEnvironment::TestAccessToSG File: .\NetEnvironment.cpp Line: 1385 Invoked Function: CNetEnvironment::analyzeHttpResponse Return Code: -28966899 (0xFE46000D) Description: NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target</Data>
      </EventData>

    HI and welcome to Discussions,
    in my personal opinion there is not much for you to worry about.
    The 'Windows Tool for the elimination of malware' is nothing you miss as long as you have a decent Anti-Virus Software running.
    The update for the IE 7 might be missing an installed IE 7, which can do by downloading it yourself from Microsofts webpage.
    If you don't use the IE but something like Firefox or Opera or Safari, than don't bother with these update.
    Stefan

  • Samsung Tab 10.1 WiFi Balck 2014 Edition - Anyconnect and IPSec don't work

    I have an employee with a Samsung Tab 10.1 2014  black wifi only edition tablet. She has tried to use both an IPsec connection and the Anyconnect for ICS+ (and the Anyconnect normal Android client and also the OpenConnect open source alternative to Anyconnect).
    The problematic behavior is the same on any VPN connection. The vpn client connects and then no traffic makes use of it. I can see the VPN session on the firewall and it shows no decrypted/decapsulated packets. Additionally, the tablet loses all internet access once the VPN connects (whether it is IPsec or Anyconnect) even though the VPN is set to use split tunneling (and I can see in the connection details that it is only set to tunnel a couple of /24 networks in the 10.x.x.x range).
    I have at least 20 other users that use the same VPN session groups with a variety of Windows, iOS and Android devices and so far, this Samsung tablet is the only problem.
    I have tried different accounts on this tablet and I have tried this employee's account on other devices and the problem remains only on the tablet. Her account works great logging in on my Samsung Galaxy S4 using both IPsec and Anyconnect client software. My account shows the same problem as her account when used on her tablet.
    I have applied all available updates on her tablet, it is currently running Android 4.4.2 and there are no updates available from Samsung for it.
    My phone is running 4.4.4 but the client app versions are the same on both devices.
    She has even exchanged the tablet for a replacement of the same model.
    Can anyone suggest any additional troubleshooting or cause for this problem?
    Basically it is as if the vpn client software works fine but the Android operating system simply ignores it except to stop all internet access.

    The warranty entitles you to complimentary phone support.
    If you bought the product in the U.S. directly from Apple (not from a reseller), you have 14 days from the date of delivery in which to exchange or return it for a refund. In other countries, the return policy may be different. If you bought from a reseller, its return policy applies.

  • Jabber for IPhone over AnyConnect VPN calls to SIP Gateway - One Way Audio

    Hello,
    I am wondering if anyone has seen this before.  I have the latest version of Anyconnect for the IPhone and Jabber app, running on the newest version of CUCM 8.6 and Jabber 8.6.
    The Jabber phone registers fine and I can make internal calls without an issue.  I also can make external calls to H323 and HGCP PRI gateways without an issue.  However, when I make a call from the Jabber client that goes out a SIP gateway and SIP trunk I get one way audio.  I do not see any packets even trying to leave inside interface of the ASA headed toward the SIP trunk IP.
    I've also verified that useing the same VPN profile I can make 2 way audio calls out the SIP trunk from a softphone running on windows.
    Anyone have any ideas what could be the problem?
    Thanks.

    Hi,
    try to disable early media on 180 under sip profile settings for jabber client.
    HTH
    Anas
    please rate if itnis helpful
    Sent from Cisco Technical Support Android App

  • Jabber for IPhone/IPad and Anyconnect VPN

    I have just setup Jabber for iPhone and iPad in a CUCM 8.6/Presence 8.6 enviornment.  Works great when on my wireless network at work.
    The problem I have is that it doesn't work with Anyconnect VPN.  Running 8.4 code and can access the CUPS website from the iPhone/iPad when on vpn.  It just will not connect the Jabber clients.  I have attached the logs for review.
    There is only one difference in our wireless connectivity and VPN connectivity that I can think of at this point.  Could it be my DHCP configuration not offering option 150 for tftp on the VPN?  I am using a local pool on the ASA but it doesn't offer option 150 for tftp.             

    It's been a while so I don't recall exactly what I did.  That said: I want to say that I connected it via the wireless network to let it pull down it's configuration and after it pulled down the initial configuration I was good to go on VPN.

  • No Audio on either end Cisco Jabber for Windows over Cisco AnyConnect

    Our telephony staff is replacing our aging/unsupported VoIP system with a Cisco system and as the network tech, I'm trying to get Jabber for Windows to work over our AnyConnect VPN client.  Jabber to Cisco phone and Jabber to Jabber calls work fine within our LAN.  
    However, when I take a laptop to a separate internet connection and connect to the network via the VPN, I can't get any audio to pass across the system, in either direction.  If I call a phone on our LAN using the Jabber client (via AnyConnect), the phone rings and when I answer it, it's just dead air on both ends.  If I reverse the process, calling from the phone to the Jabber client, the same thing, Jabber client rings, but dead air both ways once I answer.  
    Things I can do from the laptop over the VPN connection:
    I'm able to get to the phone's web interface using that same laptop.
    I can ping the phone as well.  In fact, the VPN profile I'm using has full access to the entire VoIP Vlan including all IP traffic (all ~65,000 ports).
    Searching the address book also works fine.  I can search for staff and it's pulling directly from our Active Directory environment.
    Is there any special settings on the firewall that I need to setup to allow the voice traffic (which I assume is RTP traffic)?  I tried to add a service policy for RTP traffic, but that didn't seem to work...unless I built it wrong.
    Jabber for Windows - 10.6.0
    Cisco Anyconnect - 3.1.06079
    Cisco 5515-x ASA - 9.2

    I was able to resolve this on my own.  I thought that SIP traffic needed to be inspected via the global inspection policy in order for it to pass through the firewall. I ran into the same issue with ICMP traffic from an Anyconnect client to LAN devices. I had to enable ICMP in that policy for us to be able to ping LAN devices over the VPN tunnel. So when I saw that SIP was already being inspected by this policy, I moved on looking for other solutions. Then I stumbled deep within a Google search (almost hit the end of the Internet doing so) where someone mentioned that SIP shouldn’t be inspected by that policy. So I unchecked it and bam! Voice is now working over the anyconnect client to phones on the LAN. 

  • Cisco ASA 5505 AnyConnect SSL VPN problem

    Hi!
    I have a small network, wiht ASA 5505, 8.4:
    Inside network: 192.168.2.0/24
    Outside: Static IP
    I would like to deploy a SSL AnyConnect setup.
    The state:
    -I give the correct IP from my predefined VPN pool (10.10.10.0/24).
    But, could not reach any resource, could not ping too. My host has given 10.10.10.1 IP, and I had a GW: 10.10.10.2. Where is this GW from?
    Could you help me?
    Here is my config (I omitted my PUBLIC IP, and GW): 
    Result of the command: "show running-config"
    : Saved
    ASA Version 8.4(4)1
    hostname valamiASA
    domain-name valami.local
    enable password OeyyCrIqfUEmzen8 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    switchport access vlan 12
    interface Vlan1
    description LAN
    no forward interface Vlan12
    nameif inside
    security-level 100
    ip address 192.168.2.1 255.255.255.0
    interface Vlan2
    description WAN
    nameif outside
    security-level 0
    ip address MY_STATIC_IP 255.255.255.248
    interface Vlan12
    description Vendegeknek a valamiHotSpot WiFi-hez
    nameif guest
    security-level 100
    ip address 192.168.4.1 255.255.255.0
    management-only
    ftp mode passive
    clock timezone GMT 0
    dns domain-lookup inside
    dns domain-lookup outside
    dns domain-lookup guest
    dns server-group DefaultDNS
    name-server 62.112.192.4
    name-server 195.70.35.66
    domain-name valami.local
    same-security-traffic permit intra-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network inside-net
    subnet 192.168.2.0 255.255.255.0
    object network guest-net
    subnet 192.168.3.0 255.255.255.0
    object network NETWORK_OBJ_192.168.2.128_25
    subnet 192.168.2.128 255.255.255.128
    object-group protocol DM_INLINE_PROTOCOL_3
    protocol-object ip
    protocol-object icmp
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object ip
    protocol-object icmp
    object-group protocol DM_INLINE_PROTOCOL_2
    protocol-object ip
    protocol-object icmp
    access-list global_access extended permit object-group DM_INLINE_PROTOCOL_3 any any
    access-list AnyConnect_Client_Local_Print extended deny ip any any
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns
    access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_2 any any
    access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_1 any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu guest 1500
    ip local pool valami_vpn_pool 10.10.10.1-10.10.10.10 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    no asdm history enable
    arp timeout 14400
    object network inside-net
    nat (inside,outside) dynamic interface
    object network guest-net
    nat (guest,outside) dynamic interface
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    access-group global_access global
    route outside 0.0.0.0 0.0.0.0 MY_STATIC_GW 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa local authentication attempts max-fail 16
    http server enable
    http 192.168.2.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    telnet timeout 5
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics host
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable inside
    enable outside
    anyconnect-essentials
    anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    anyconnect enable
    tunnel-group-list enable
    group-policy GroupPolicy_valami_VPN internal
    group-policy GroupPolicy_valami_VPN attributes
    wins-server value 192.168.2.2
    dns-server value 192.168.2.2
    vpn-tunnel-protocol ssl-client
    split-tunnel-policy tunnelall
    default-domain value valami.local
    webvpn
      anyconnect ssl rekey time 30
      anyconnect ssl rekey method ssl
      anyconnect ask enable default anyconnect timeout 30
      customization none
      deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission to use any of the VPN features. Contact your IT administrator for more information.
    username test password P4ttSyrm33SV8TYp encrypted
    tunnel-group valami_VPN type remote-access
    tunnel-group valami_VPN general-attributes
    address-pool valami_vpn_pool
    default-group-policy GroupPolicy_valami_VPN
    tunnel-group valami_VPN webvpn-attributes
    group-alias valami_VPN enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:d54de340bb6794d90a9ee52c69044753
    : end

    First of all thanks your link.
    I know your notes, but i don't understand 1 thing:
    if i check nat exemption in the anyconnect wizad, why should i make nat exemption rule?
    A tried creating a roule, but it is wrong.
    My steps (on ASDM):
    1: create network object (10.10.10.0/24), named VPN
    2: create nat rule: source any, destination VPN, protocol any
    Here is my config:
    Result of the command: "show running-config"
    : Saved
    ASA Version 8.4(4)1
    hostname companyASA
    domain-name company.local
    enable password OeyyCrIqfUEmzen8 encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    switchport access vlan 12
    interface Vlan1
    description LAN
    no forward interface Vlan12
    nameif inside
    security-level 100
    ip address 192.168.2.1 255.255.255.0
    interface Vlan2
    description WAN
    nameif outside
    security-level 0
    ip address 77.111.103.106 255.255.255.248
    interface Vlan12
    description Vendegeknek a companyHotSpot WiFi-hez
    nameif guest
    security-level 100
    ip address 192.168.4.1 255.255.255.0
    ftp mode passive
    clock timezone CEST 1
    clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
    dns domain-lookup inside
    dns domain-lookup outside
    dns domain-lookup guest
    dns server-group DefaultDNS
    name-server 62.112.192.4
    name-server 195.70.35.66
    domain-name company.local
    same-security-traffic permit intra-interface
    object network obj_any
    subnet 0.0.0.0 0.0.0.0
    object network inside-net
    subnet 192.168.2.0 255.255.255.0
    object network guest-net
    subnet 192.168.3.0 255.255.255.0
    object network NETWORK_OBJ_192.168.2.128_25
    subnet 192.168.2.128 255.255.255.128
    object network WEBSHOP
    host 192.168.2.2
    object network INSIDE_HOST
    host 10.100.130.5
    object network VOIP_management
    host 192.168.2.215
    object network Dev_1
    host 192.168.2.2
    object network Dev_2
    host 192.168.2.2
    object network RDP
    host 192.168.2.2
    object network Mediasa
    host 192.168.2.17
    object network VOIP_ePhone
    host 192.168.2.215
    object network NETWORK_OBJ_192.168.4.0_28
    subnet 192.168.4.0 255.255.255.240
    object network NETWORK_OBJ_10.10.10.8_29
    subnet 10.10.10.8 255.255.255.248
    object network VPN
    subnet 10.10.10.0 255.255.255.0
    object network VPN-internet
    subnet 10.10.10.0 255.255.255.0
    object-group protocol DM_INLINE_PROTOCOL_3
    protocol-object ip
    protocol-object icmp
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object ip
    protocol-object icmp
    object-group protocol DM_INLINE_PROTOCOL_2
    protocol-object ip
    protocol-object icmp
    access-list global_access extended permit object-group DM_INLINE_PROTOCOL_3 any any
    access-list AnyConnect_Client_Local_Print extended deny ip any any
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any host 224.0.0.252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any any eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any any eq netbios-ns
    access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_2 any any
    access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_1 any any
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu guest 1500
    ip local pool company_vpn_pool 10.10.10.10-10.10.10.15 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    no asdm history enable
    arp timeout 14400
    nat (any,any) source static any any destination static VPN VPN
    nat (inside,outside) source static inside-net inside-net destination static VPN VPN
    object network inside-net
    nat (inside,outside) dynamic interface
    object network guest-net
    nat (guest,outside) dynamic interface
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    access-group global_access global
    route outside 0.0.0.0 0.0.0.0 77.111.103.105 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    aaa local authentication attempts max-fail 16
    http server enable
    http 192.168.2.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    telnet timeout 5
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcpd auto_config outside
    threat-detection basic-threat
    threat-detection statistics host
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable inside
    enable outside
    anyconnect-essentials
    anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    anyconnect enable
    tunnel-group-list enable
    group-policy GroupPolicy_company_VPN internal
    group-policy GroupPolicy_company_VPN attributes
    wins-server value 192.168.2.2
    dns-server value 192.168.2.2
    vpn-tunnel-protocol l2tp-ipsec
    split-tunnel-policy tunnelall
    default-domain value company.local
    webvpn
      anyconnect ssl rekey time 30
      anyconnect ssl rekey method ssl
      anyconnect ask enable default anyconnect timeout 30
      customization none
      deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission to use any of the VPN features. Contact your IT administrator for more information.
    group-policy GroupPolicy_VPN internal
    group-policy GroupPolicy_VPN attributes
    wins-server none
    dns-server value 62.112.192.4 195.70.35.66
    vpn-tunnel-protocol ssl-client
    default-domain value company.local
    username test password P4ttSyrm33SV8TYp encrypted
    tunnel-group company_VPN type remote-access
    tunnel-group company_VPN general-attributes
    address-pool company_vpn_pool
    default-group-policy GroupPolicy_company_VPN
    tunnel-group company_VPN webvpn-attributes
    group-alias company_VPN enable
    tunnel-group VPN type remote-access
    tunnel-group VPN general-attributes
    address-pool company_vpn_pool
    default-group-policy GroupPolicy_VPN
    tunnel-group VPN webvpn-attributes
    group-alias VPN enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
      inspect icmp error
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    Cryptochecksum:33ee37a3722f228f9be9b84ef43f731e
    : end
    Could you give me a CLI-code?
    (or ASDM steps).

  • Cisco ASA 5505 VPN Anyconnect no address assignment

    I have a problem with ip assigment via anyconnect. I always get the message no assigned address via anyconnect. I assigned to my profile for vpn a address pool, but it's still not working. Here is my config:
    hostname firewall
    domain-name ITTRIPP.local
    enable password 8K8UeTZ9KV5Lvofo encrypted
    xlate per-session deny tcp any4 any4
    xlate per-session deny tcp any4 any6
    xlate per-session deny tcp any6 any4
    xlate per-session deny tcp any6 any6
    xlate per-session deny udp any4 any4 eq domain
    xlate per-session deny udp any4 any6 eq domain
    xlate per-session deny udp any6 any4 eq domain
    xlate per-session deny udp any6 any6 eq domain
    names
    ip local pool 192.168.178.0 192.168.178.151-192.168.178.171 mask 255.255.255.255
    ip local pool net-10 10.0.0.1-10.0.0.10 mask 255.255.255.0
    ip local pool SSL-POOL 172.16.1.1-172.16.1.254 mask 255.255.255.0
    interface Ethernet0/0
     switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
     switchport access vlan 3
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
     description Private Interface
     nameif inside
     security-level 100
     ip address 192.168.178.10 255.255.255.0
     ospf cost 10
    interface Vlan2
     description Public Interface
     nameif outside
     security-level 0
     ip address 192.168.177.2 255.255.255.0
     ospf cost 10
    interface Vlan3
     description DMZ-Interface
     nameif dmz
     security-level 0
     ip address 10.10.10.2 255.255.255.0
    boot system disk0:/asa914-k8.bin
    ftp mode passive
    dns domain-lookup inside
    dns domain-lookup outside
    dns domain-lookup dmz
    dns server-group DefaultDNS
     name-server 192.168.178.3
     name-server 192.168.177.1
     domain-name ITTRIPP.local
    same-security-traffic permit inter-interface
    same-security-traffic permit intra-interface
    object network 192.168.178.x
     subnet 192.168.178.0 255.255.255.0
    object network NETWORK_OBJ_192.168.178.0_26
     subnet 192.168.178.0 255.255.255.192
    object service teamviewer
     service tcp source eq 5938
    object service smtp_tls
     service tcp source eq 587
    object service all_tcp
     service tcp source range 1 65535
    object service udp_all
     service udp source range 1 65535
    object network NETWORK_OBJ_192.168.178.128_26
     subnet 192.168.178.128 255.255.255.192
    object network NETWORK_OBJ_10.0.0.0_28
     subnet 10.0.0.0 255.255.255.240
    object-group service Internet-udp udp
     description UDP Standard Internet Services
     port-object eq domain
     port-object eq ntp
     port-object eq isakmp
     port-object eq 4500
    object-group service Internet-tcp tcp
     description TCP Standard Internet Services
     port-object eq www
     port-object eq https
     port-object eq smtp
     port-object eq 465
     port-object eq pop3
     port-object eq 995
     port-object eq ftp
     port-object eq ftp-data
     port-object eq domain
     port-object eq ssh
     port-object eq telnet
    object-group user DM_INLINE_USER_1
     user LOCAL\admin
     user LOCAL\lukas
     user LOCAL\sarah
    object-group service DM_INLINE_TCP_1 tcp
     port-object eq ftp
     port-object eq ftp-data
     port-object eq ssh
    object-group service 192.168.178.network tcp
     port-object eq 5000
     port-object eq 5001
    object-group service DM_INLINE_SERVICE_1
     service-object object smtp_tls
     service-object tcp destination eq imap4
     service-object object teamviewer
    object-group service DM_INLINE_SERVICE_2
     service-object object all_tcp
     service-object object udp_all
    object-group service DM_INLINE_SERVICE_3
     service-object object all_tcp
     service-object object smtp_tls
     service-object object teamviewer
     service-object object udp_all
     service-object tcp destination eq imap4
    object-group service vpn udp
     port-object eq 1701
     port-object eq 4500
     port-object eq isakmp
    object-group service openvpn udp
     port-object eq 1194
    access-list NAT-ACLs extended permit ip 192.168.178.0 255.255.255.0 any
    access-list inside-in remark -=[Access Lists For Outgoing Packets from Inside in                                                                                                                    terface]=-
    access-list inside-in extended permit udp 192.168.178.0 255.255.255.0 any object                                                                                                                    -group Internet-udp
    access-list inside-in extended permit tcp 192.168.178.0 255.255.255.0 any object                                                                                                                    -group Internet-tcp
    access-list inside-in extended permit icmp 192.168.178.0 255.255.255.0 any
    access-list inside-in extended permit udp 192.168.178.0 255.255.255.0 any eq sip                                                                                                                    
    access-list inside-in extended permit object-group DM_INLINE_SERVICE_1 192.168.1                                                                                                                    78.0 255.255.255.0 any
    access-list inside-in extended permit object-group DM_INLINE_SERVICE_2 192.168.1                                                                                                                    78.0 255.255.255.0 any
    access-list outside-in remark -=[Access Lists For Incoming Packets on OUTSIDE in                                                                                                                    terface]=-
    access-list outside-in extended permit icmp any 192.168.178.0 255.255.255.0 echo                                                                                                                    -reply
    access-list outside-in extended permit tcp object-group-user DM_INLINE_USER_1 an                                                                                                                    y host 192.168.178.95 object-group DM_INLINE_TCP_1
    access-list outside-in extended permit tcp any host 192.168.178.95 object-group                                                                                                                     192.168.178.network
    access-list outside-in extended permit tcp any 192.168.178.0 255.255.255.0 eq si                                                                                                                    p
    access-list AnyConnect_Client_Local_Print extended deny ip any4 any4
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd
    access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631
    access-list AnyConnect_Client_Local_Print remark Windows' printing port
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100
    access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.                                                                                                                    251 eq 5353
    access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Nam                                                                                                                    e Resolution protocol
    access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.                                                                                                                    252 eq 5355
    access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol
    access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137
    access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbi                                                                                                                    os-ns
    access-list dmz_access_in remark -=[Access Lists For Outgoing Packets from DMZ i                                                                                                                    nterface]=-
    access-list dmz_access_in extended permit object-group DM_INLINE_SERVICE_3 10.10                                                                                                                    .10.0 255.255.255.0 any
    access-list dmz_access_in extended permit icmp 10.10.10.0 255.255.255.0 any
    access-list dmz_access_in extended permit tcp 10.10.10.0 255.255.255.0 any objec                                                                                                                    t-group Internet-tcp
    access-list dmz_access_in extended permit udp 10.10.10.0 255.255.255.0 any objec                                                                                                                    t-group Internet-udp
    pager lines 24
    logging enable
    logging buffer-size 30000
    logging buffered debugging
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static any any destination static NETWORK_OBJ_192.16                                                                                                                    8.178.0_26 NETWORK_OBJ_192.168.178.0_26 no-proxy-arp route-lookup
    nat (dmz,outside) source static any any destination static NETWORK_OBJ_192.168.1                                                                                                                    78.0_26 NETWORK_OBJ_192.168.178.0_26 no-proxy-arp route-lookup
    nat (inside,outside) source static any any destination static NETWORK_OBJ_192.16                                                                                                                    8.178.128_26 NETWORK_OBJ_192.168.178.128_26 no-proxy-arp route-lookup
    nat (inside,outside) source static any any destination static NETWORK_OBJ_10.0.0                                                                                                                    .0_28 NETWORK_OBJ_10.0.0.0_28 no-proxy-arp route-lookup
    object network 192.168.178.x
     nat (inside,outside) dynamic interface
    nat (dmz,outside) after-auto source dynamic 192.168.178.x interface
    access-group inside-in in interface inside
    access-group outside-in in interface outside
    access-group dmz_access_in in interface dmz
    route outside 0.0.0.0 0.0.0.0 192.168.177.1 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa-server ITTRIPP protocol ldap
    aaa-server ITTRIPP (inside) host 192.168.178.3
     ldap-base-dn CN=Users,DC=ITTRIPP,DC=local
     ldap-scope subtree
     ldap-naming-attribute sAMAccountName
     ldap-login-password *****
     ldap-login-dn CN=Administrator,DC=ITTRIPP,DC=local
     server-type microsoft
    user-identity default-domain LOCAL
    eou allow none
    aaa authentication telnet console LOCAL
    aaa authentication http console LOCAL
    aaa authentication ssh console LOCAL
    aaa local authentication attempts max-fail 5
    http server enable
    http 192.168.178.0 255.255.255.0 inside
    http redirect outside 80
    http redirect inside 80
    http redirect dmz 80
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal DES
     protocol esp encryption des
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
     protocol esp encryption 3des
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
     protocol esp encryption aes
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
     protocol esp encryption aes-192
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
     protocol esp encryption aes-256
     protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-A                                                                                                                    ES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-A                                                                                                                    ES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES2                                                                                                                    56 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto map dmz_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map dmz_map interface dmz
    crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map inside_map interface inside
    crypto ca trustpoint ASDM_TrustPoint0
     enrollment self
     subject-name CN=firewall
     crl configure
    crypto ca trustpoint ASDM_TrustPoint1
     enrollment self
     fqdn l1u.dyndns.org
     email [email protected]
     subject-name CN=l1u.dyndns.org,OU=VPN Services,O=ITTRIPP,C=DE,St=NRW,L=PLBG,EA=                                                                                                                    [email protected]
     serial-number
     crl configure
    crypto ca trustpool policy
    crypto ca certificate chain ASDM_TrustPoint0
     certificate 6a871953
        308201cf 30820138 a0030201 0202046a 87195330 0d06092a 864886f7 0d010105
        0500302c 3111300f 06035504 03130866 69726577 616c6c31 17301506 092a8648
        86f70d01 09021608 66697265 77616c6c 301e170d 31343033 30373039 31303034
        5a170d32 34303330 34303931 3030345a 302c3111 300f0603 55040313 08666972
        6577616c 6c311730 1506092a 864886f7 0d010902 16086669 72657761 6c6c3081
        9f300d06 092a8648 86f70d01 01010500 03818d00 30818902 818100c0 8f17fa6c
        2f227dd9 9d2856e1 b1f8193b 13c61cfe 2d6cbf94 62373535 71db9ac7 5f4ad79f
        7594cfef 1360d88d ad3c69c1 6e617071 c6629bfa 3c77c2d2 a59b1ce1 39ae7a44
        3f8c852d f51d03c1 d9924f7c 24747bbb bf79af9a 68365ed8 7f56e58c a37c7036
        4db983e0 414d1b5e a8a2226f 7c76f50d d14ca714 252f7fbb d4a23d02 03010001
        300d0609 2a864886 f70d0101 05050003 81810019 0d0bbce4 31d9342c 3965eb56
        4dde42e0 5ea57cbb a79b3542 4897521a 8a6859c6 daf5e356 9526346d f13fb344
        260f3fc8 fca6143e 25b08f3d d6780448 3e0fdf6a c1fe5379 1b9227b1 cee01a20
        aa252698 6b29954e ea8bb250 4310ff96 f6c6f0dc 6c7c6021 3c72c756 f7b2e6a1
        1416d222 0e11ca4a 0f0b840a 49489303 b76632
      quit
    crypto ca certificate chain ASDM_TrustPoint1
     certificate 580c1e53
        308202ff 30820268 a0030201 02020458 0c1e5330 0d06092a 864886f7 0d010105
        05003081 c3312230 2006092a 864886f7 0d010901 16136d61 696c406c 31752e64
        796e646e 732e6f72 67310d30 0b060355 04071304 504c4247 310c300a 06035504
        0813034e 5257310b 30090603 55040613 02444531 10300e06 0355040a 13074954
        54524950 50311530 13060355 040b130c 56504e20 53657276 69636573 31173015
        06035504 03130e6c 31752e64 796e646e 732e6f72 67313130 12060355 0405130b
        4a4d5831 3533345a 30575430 1b06092a 864886f7 0d010902 160e6c31 752e6479
        6e646e73 2e6f7267 301e170d 31343033 31353036 35303535 5a170d32 34303331
        32303635 3035355a 3081c331 22302006 092a8648 86f70d01 09011613 6d61696c
        406c3175 2e64796e 646e732e 6f726731 0d300b06 03550407 1304504c 4247310c
        300a0603 55040813 034e5257 310b3009 06035504 06130244 45311030 0e060355
        040a1307 49545452 49505031 15301306 0355040b 130c5650 4e205365 72766963
        65733117 30150603 55040313 0e6c3175 2e64796e 646e732e 6f726731 31301206
        03550405 130b4a4d 58313533 345a3057 54301b06 092a8648 86f70d01 0902160e
        6c31752e 64796e64 6e732e6f 72673081 9f300d06 092a8648 86f70d01 01010500
        03818d00 30818902 818100c0 8f17fa6c 2f227dd9 9d2856e1 b1f8193b 13c61cfe
        2d6cbf94 62373535 71db9ac7 5f4ad79f 7594cfef 1360d88d ad3c69c1 6e617071
        c6629bfa 3c77c2d2 a59b1ce1 39ae7a44 3f8c852d f51d03c1 d9924f7c 24747bbb
        bf79af9a 68365ed8 7f56e58c a37c7036 4db983e0 414d1b5e a8a2226f 7c76f50d
        d14ca714 252f7fbb d4a23d02 03010001 300d0609 2a864886 f70d0101 05050003
        81810087 8aca9c2b 40c9a326 4951c666 44c311b6 5f3914d5 69fcbe0a 13985b51
        336e3c1b ae29c922 c6c1c29d 161fd855 984b6148 c6cbd50f ff3dde66 a71473c4
        ea949f87 b4aca243 8151acd8 a4a426d1 7a434fbd 1a14bd90 0abe5736 4cd0f21b
        d194b3d6 9ae45fab 2436ccbf d59d6ba9 509580a0 ad8f4131 39e6ccf1 1b7a125d
        d50e4e
      quit
    crypto ikev2 policy 1
     encryption aes-256
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 10
     encryption aes-192
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 20
     encryption aes
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 30
     encryption 3des
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 40
     encryption des
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 enable inside client-services port 443
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 enable dmz client-services port 443
    crypto ikev2 remote-access trustpoint ASDM_TrustPoint1
    crypto ikev1 enable outside
    crypto ikev1 policy 10
     authentication crack
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 20
     authentication rsa-sig
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 30
     authentication pre-share
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 40
     authentication crack
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 50
     authentication rsa-sig
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 60
     authentication pre-share
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 70
     authentication crack
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 80
     authentication rsa-sig
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 90
     authentication pre-share
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 100
     authentication crack
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 110
     authentication rsa-sig
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 120
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 130
     authentication crack
     encryption des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 140
     authentication rsa-sig
     encryption des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 150
     authentication pre-share
     encryption des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 65535
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    telnet 192.168.178.0 255.255.255.0 inside
    telnet timeout 5
    ssh 192.168.178.0 255.255.255.0 inside
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    no vpn-addr-assign aaa
    no vpn-addr-assign local
    no ipv6-vpn-addr-assign aaa
    dhcp-client update dns server both
    dhcpd update dns both
    dhcpd address 192.168.178.100-192.168.178.150 inside
    dhcpd dns 192.168.178.3 192.168.177.1 interface inside
    dhcpd wins 192.168.178.3 interface inside
    dhcpd domain ITTRIPP.local interface inside
    dhcpd update dns both interface inside
    dhcpd option 3 ip 192.168.178.10 interface inside
    dhcpd option 4 ip 192.168.178.3 interface inside
    dhcpd option 6 ip 192.168.178.3 192.168.177.1 interface inside
    dhcpd option 66 ip 192.168.178.95 interface inside
    dhcpd enable inside
    dhcpd address 192.168.177.100-192.168.177.150 outside
    dhcpd dns 192.168.178.3 192.168.177.1 interface outside
    dhcpd wins 192.168.178.3 interface outside
    dhcpd domain ITTRIPP.local interface outside
    dhcpd update dns both interface outside
    dhcpd option 3 ip 192.168.177.2 interface outside
    dhcpd option 4 ip 192.168.178.3 interface outside
    dhcpd option 6 ip 192.168.178.3 interface outside
    dhcpd enable outside
    dhcpd address 10.10.10.100-10.10.10.150 dmz
    dhcpd dns 192.168.178.3 192.168.177.1 interface dmz
    dhcpd wins 192.168.178.3 interface dmz
    dhcpd domain ITTRIPP.local interface dmz
    dhcpd update dns both interface dmz
    dhcpd option 3 ip 10.10.10.2 interface dmz
    dhcpd option 4 ip 192.168.178.3 interface dmz
    dhcpd option 6 ip 192.168.178.3 interface dmz
    dhcpd enable dmz
    threat-detection basic-threat
    threat-detection statistics
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 averag                                                                                                                    e-rate 200
    tftp-server inside 192.168.178.105 /volume1/data/tftp
    ssl encryption 3des-sha1
    ssl trust-point ASDM_TrustPoint0
    ssl trust-point ASDM_TrustPoint1 outside
    ssl trust-point ASDM_TrustPoint1 dmz
    ssl trust-point ASDM_TrustPoint0 dmz vpnlb-ip
    ssl trust-point ASDM_TrustPoint1 inside
    ssl trust-point ASDM_TrustPoint0 inside vpnlb-ip
    ssl trust-point ASDM_TrustPoint0 outside vpnlb-ip
    webvpn
     enable inside
     enable outside
     enable dmz
     file-encoding 192.168.178.105 big5
     csd image disk0:/csd_3.5.2008-k9.pkg
     anyconnect image disk0:/anyconnect-linux-3.1.03103-k9.pkg 1
     anyconnect image disk0:/anyconnect-macosx-i386-3.1.03103-k9.pkg 2
     anyconnect image disk0:/anyconnect-win-3.1.03103-k9.pkg 3
     anyconnect profiles SSL-Profile_client_profile disk0:/SSL-Profile_client_profil                                                                                                                    e.xml
     anyconnect enable
     tunnel-group-list enable
     mus password *****
    group-policy DfltGrpPolicy attributes
     wins-server value 192.168.178.3
     dns-server value 192.168.178.3 192.168.177.1
     dhcp-network-scope 192.168.178.0
     vpn-tunnel-protocol ikev2 ssl-client ssl-clientless
     default-domain value ITTRIPP.local
     split-dns value ITTRIPP.local
     webvpn
      anyconnect firewall-rule client-interface public value outside-in
      anyconnect firewall-rule client-interface private value inside-in
    group-policy GroupPolicy_SSL-Profile internal
    group-policy GroupPolicy_SSL-Profile attributes
     wins-server value 192.168.178.3
     dns-server value 192.168.178.3 192.168.177.1
     vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
     default-domain value ITTRIPP.local
     webvpn
      anyconnect profiles value SSL-Profile_client_profile type user
    username sarah password PRgJuqNTubRwqXtd encrypted
    username admin password QkbxX5Qv0P59Hhrx encrypted privilege 15
    username lukas password KGLLoTxH9mCvWzVI encrypted
    tunnel-group DefaultWEBVPNGroup general-attributes
     address-pool SSL-POOL
     secondary-authentication-server-group LOCAL
     authorization-server-group LOCAL
    tunnel-group DefaultWEBVPNGroup ipsec-attributes
     ikev1 trust-point ASDM_TrustPoint0
     ikev1 radius-sdi-xauth
    tunnel-group SSL-Profile type remote-access
    tunnel-group SSL-Profile general-attributes
     address-pool SSL-POOL
     default-group-policy GroupPolicy_SSL-Profile
    tunnel-group SSL-Profile webvpn-attributes
     group-alias SSL-Profile enable
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect ip-options
      inspect netbios
      inspect rsh
      inspect rtsp
      inspect skinny
      inspect esmtp
      inspect sqlnet
      inspect sunrpc
      inspect tftp
      inspect sip
      inspect xdmcp
     class class-default
      user-statistics accounting
    service-policy global_policy global
    mount FTP type ftp
     server 192.168.178.105
     path /volume1/data/install/microsoft/Cisco
     username lukas
     password ********
     mode passive
     status enable
    prompt hostname context
    no call-home reporting anonymous
    call-home
     profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DD                                                                                                                    CEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:998674b777e5fd1d3a131d93704ea0e1
    Any idea why it's not working?

    You've got a lot going on there but I'd focus on the line "no vpn-addr-assign local". Per the command reference that tells the ASA NOT to use the  local pool.
    By the way, DHCP on the outside interface looks very counter-intutive, as does enabling VPN on all interfaces over every protocol.

  • Anyconnect 3.1 Captive Portal False Alert Stops Users Connecting.

    Hi All,
    I am having problems with a customer's ASA 5505 with Anyconnect 3.1 - it is generating captive portal false-alerts which are stopping users from connecting.
    This issue began when I upgraded from Anyconnect 2.4 to 3.1, and it appears like this: A user downloads and installs the Anyconnect client and is able to connect fine, to begin with. However, once they reboot their computer and try to reconnect, the VPN session will not come up and they receive the error message below.
    "The service provider in your current location is restricting access to the internet. You need to log on with the service provider before you can establish a VPN session. You can try this by visiting any website with your browser."
    Reading other posts, it seems this message appears when a captive portal is restricting internet access. It must be a false alert in this case as there is nothing of the sort here. Apparently, Anyconnect 3.1 can generate a false alert like so if the name of the firewall's SSL certificate doesn't match the CName listed on the Client Profile. I've set this up to match, to no avail.
    Although users can connect by reauthenticating through the SSL VPN login web page, I am stumped as to how to get rid of this captive portal error that pops up when they try to use the Anyconnect client.
    Any advice would be appreciated, just let me know what extra details to post if needed.
    Many thanks,
    Josh Campbell

    Hi Joshua,
    The below information could be located at
    www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect31/administration/guide/ac03vpn.html
    False Captive Portal Detection
    AnyConnect can falsely assume it is in a captive portal in the following situations.
    •If AnyConnect attempts to contact an ASA with a certificate containing an incorrect server name (CN), then the AnyConnect client will think it is in a "captive portal" environment.
    To prevent this, make sure the ASA certificate is properly configured. The CN value in the certificate must match the name of the ASA server in the VPN client profile.
    •If there is another device on the network before the ASA, and that device responds to the client's attempt to contact an ASA by blocking HTTPS access to the ASA, then the AnyConnect client will think it is in a "captive portal" environment. This situation can occur when a user is on an internal network, and connects through a firewall to connect to the ASA.
    If you need to restrict access to the ASA from inside the corporation, configure your firewall such that HTTP and HTTPS traffic  to the ASA's address does not return an HTTP status. HTTP/HTTPS access to the ASA should either be allowed or completely  blocked (also known as black-holed) to ensure that HTTP/HTTPS requests sent
    There is also a bug filed for this. Just for your reference,
    CSCud17825 - Anyconnect captive portal
    Regards,
    Srikanth K S.

  • Cisco ASA 5515 - Anyconnect users can't ping other Anyconnect users. How can I allow icmp traffic between Anyconnect users?

    ASA configuration is  below!
    ASA Version 9.1(1)
    hostname ASA
    domain-name xxx.xx
    names
    ip local pool VPN_CLIENT_POOL 192.168.12.1-192.168.12.254 mask 255.255.255.0
    interface GigabitEthernet0/0
    nameif inside
    security-level 100
    ip address 192.168.11.1 255.255.255.0
    interface GigabitEthernet0/1
    description Interface_to_VPN
    nameif outside
    security-level 0
    ip address 111.222.333.444 255.255.255.240
    interface GigabitEthernet0/2
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/3
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/4
    shutdown
    no nameif
    no security-level
    no ip address
    interface GigabitEthernet0/5
    shutdown
    no nameif
    no security-level
    no ip address
    interface Management0/0
    management-only
    nameif management
    security-level 100
    ip address 192.168.5.1 255.255.255.0
    ftp mode passive
    dns server-group DefaultDNS
    domain-name www.ww
    same-security-traffic permit intra-interface
    object network LAN
    subnet 192.168.11.0 255.255.255.0
    description LAN
    object network SSLVPN_POOL
    subnet 192.168.12.0 255.255.255.0
    access-list VPN_CLIENT_ACL standard permit 192.168.11.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu management 1500
    no failover
    icmp unreachable rate-limit 1 burst-size 1
    asdm image disk0:/asdm-711.bin
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (outside,inside) source static SSLVPN_POOL SSLVPN_POOL destination static LAN LAN
    route outside 0.0.0.0 0.0.0.0 111.222.333.443 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    webvpn
      url-list none
    user-identity default-domain LOCAL
    aaa authentication ssh console LOCAL
    aaa authentication http console LOCAL
    aaa authorization exec LOCAL
    http server enable
    http 192.168.5.0 255.255.255.0 management
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec security-association pmtu-aging infinite
    crypto ca trustpoint ASDM_TrustPoint5
    enrollment terminal
    email [email protected]
    subject-name CN=ASA
    ip-address 111.222.333.444
    crl configure
    crypto ca trustpoint ASDM_TrustPoint6
    enrollment terminal
    fqdn vpn.domain.com
    email [email protected]
    subject-name CN=vpn.domain.com
    ip-address 111.222.333.444
    keypair sslvpn
    crl configure
    crypto ca trustpool policy
    crypto ca certificate chain ASDM_TrustPoint6
    telnet timeout 5
    ssh 192.168.11.0 255.255.255.0 inside
    ssh timeout 30
    console timeout 0
    no ipv6-vpn-addr-assign aaa
    no ipv6-vpn-addr-assign local
    dhcpd address 192.168.5.2-192.168.5.254 management
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl trust-point ASDM_TrustPoint6 outside
    webvpn
    enable outside
    csd image disk0:/csd_3.5.2008-k9.pkg
    anyconnect image disk0:/anyconnect-win-3.1.04066-k9.pkg 1
    anyconnect enable
    tunnel-group-list enable
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless
    group-policy VPN_CLIENT_POLICY internal
    group-policy VPN_CLIENT_POLICY attributes
    wins-server none
    dns-server value 192.168.11.198
    vpn-simultaneous-logins 5
    vpn-session-timeout 480
    vpn-tunnel-protocol ssl-client
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value VPN_CLIENT_ACL
    default-domain value mycomp.local
    address-pools value VPN_CLIENT_POOL
    webvpn
      anyconnect ssl dtls enable
      anyconnect keep-installer installed
      anyconnect ssl keepalive 20
      anyconnect ssl rekey time 30
      anyconnect ssl rekey method ssl
      anyconnect dpd-interval client 30
      anyconnect dpd-interval gateway 30
      anyconnect dtls compression lzs
      anyconnect modules value vpngina
      customization value DfltCustomization
    group-policy IT_POLICY internal
    group-policy IT_POLICY attributes
    wins-server none
    dns-server value 192.168.11.198
    vpn-simultaneous-logins 3
    vpn-session-timeout 120
    vpn-tunnel-protocol ssl-client ssl-clientless
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value VPN_CLIENT_ACL
    default-domain value company.com
    address-pools value VPN_CLIENT_POOL
    webvpn
      anyconnect ssl dtls enable
      anyconnect keep-installer installed
      anyconnect ssl keepalive 20
      anyconnect dtls compression lzs
      customization value DfltCustomization
    username vpnuser password PA$$WORD encrypted
    username vpnuser attributes
    vpn-group-policy VPN_CLIENT_POLICY
    service-type remote-access
    username vpnuser2 password PA$$W encrypted
    username vpnuser2 attributes
    service-type remote-access
    username admin password ADMINPA$$ encrypted privilege 15
    tunnel-group VPN type remote-access
    tunnel-group VPN general-attributes
    address-pool VPN_CLIENT_POOL
    default-group-policy VPN_CLIENT_POLICY
    tunnel-group VPN webvpn-attributes
    authentication aaa certificate
    group-alias VPN_to_R enable
    tunnel-group IT_PROFILE type remote-access
    tunnel-group IT_PROFILE general-attributes
    address-pool VPN_CLIENT_POOL
    default-group-policy IT_POLICY
    tunnel-group IT_PROFILE webvpn-attributes
    authentication aaa certificate
    group-alias IT enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny
      inspect sunrpc
      inspect xdmcp
      inspect sip
      inspect netbios
      inspect tftp
      inspect ip-options
      inspect icmp
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    : end

    Hi,
    here's what you need:
    same-security-traffic permit intra-interface
    access-list VPN_CLIENT_ACL standard permit 192.168.12.0 255.255.255.0
    nat (outside,outside) source static SSLVPN_POOL SSLVPN_POOL destination static SSLVPN_POOL SSLVPN_POOL
    Patrick

  • ASA 5505 AnyConnect VPN Can RDP to clients but can't ping/icmp

    Hello all,
    I've been searching all day for a solution to this problem. I setup and SSL anyconnect VPN on my Cisco ASA 5505. It works well and connects with out a problem. However, I can't ping any internal clients, but I can RDP to them. It may be something simple and I would appreciate any help. Most of the time people end up posting their config so I will as well.
    MafSecASA# show run
    : Saved
    ASA Version 8.2(1)
    hostname MafSecASA
    domain-name mafsec.com
    names
    interface Vlan1
    nameif inside
    security-level 100
    ip address 10.4.0.1 255.255.255.0
    interface Vlan2
    nameif outside
    security-level 0
    ip address 7.3.3.2 255.255.255.248
    interface Vlan3
    no forward interface Vlan1
    nameif dmz
    security-level 50
    ip address 172.20.1.1 255.255.255.0
    interface Ethernet0/0
    switchport access vlan 2
    speed 100
    duplex full
    interface Ethernet0/1
    speed 100
    duplex full
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    interface Ethernet0/6
    interface Ethernet0/7
    switchport access vlan 3
    ftp mode passive
    clock timezone EST -5
    clock summer-time EDT recurring
    dns server-group DefaultDNS
    domain-name mafsec.com
    same-security-traffic permit intra-interface
    object-group protocol DM_INLINE_PROTOCOL_1
    protocol-object ip
    protocol-object tcp
    protocol-object udp
    protocol-object icmp
    object-group protocol DM_INLINE_PROTOCOL_2
    protocol-object ip
    protocol-object udp
    protocol-object tcp
    protocol-object icmp
    object-group protocol DM_INLINE_PROTOCOL_3
    protocol-object ip
    protocol-object icmp
    object-group protocol DM_INLINE_PROTOCOL_4
    protocol-object ip
    protocol-object icmp
    access-list inside_access_in extended permit icmp any any
    access-list inside_access_in extended permit ip any any
    access-list inside_access_in remark allow remote users to internal users
    access-list inside_access_in remark allow remote users to internal users
    access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_4 10.4.0.0 255.255.255.0 10.5.0.0 255.255.255.0
    access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_3 10.5.0.0 255.255.255.0 10.4.0.0 255.255.255.0
    access-list outside_access_in extended permit icmp any any
    access-list inside_split_tunnel standard permit 10.4.0.0 255.255.255.0
    access-list inside_split_tunnel standard permit 10.5.0.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.4.0.0 255.255.255.0 10.4.0.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.4.0.0 255.255.255.0 10.5.0.0 255.255.255.0
    access-list inside_nat0_outbound extended permit ip 10.5.0.0 255.255.255.0 10.4.0.0 255.255.255.0
    access-list inside_nat0_outbound_1 extended permit ip 10.4.0.0 255.255.255.0 10.4.0.0 255.255.255.0
    access-list inside_nat0_outbound_1 extended permit ip 10.4.0.0 255.255.255.0 10.5.0.0 255.255.255.0
    access-list inside_nat0_outbound_1 extended permit ip 10.5.0.0 255.255.255.0 10.4.0.0 255.255.255.0
    pager lines 24
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    mtu dmz 1500
    ip local pool SSLVPNPool2 10.5.0.1-10.5.0.254 mask 255.255.255.0
    ip verify reverse-path interface outside
    icmp unreachable rate-limit 1 burst-size 1
    icmp permit any inside
    icmp permit any outside
    no asdm history enable
    arp timeout 14400
    nat-control
    global (outside) 1 interface
    nat (inside) 0 access-list inside_nat0_outbound_1
    nat (inside) 1 0.0.0.0 0.0.0.0
    access-group inside_access_in in interface inside
    access-group outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 7.3.3.6 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication enable console LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 10.4.0.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto isakmp enable outside
    crypto isakmp policy 5
    authentication pre-share
    encryption 3des
    hash sha
    group 2
    lifetime 86400
    crypto isakmp policy 10
    authentication pre-share
    encryption des
    hash sha
    group 2
    lifetime 86400
    telnet timeout 5
    ssh 10.4.0.0 255.255.255.0 inside
    ssh timeout 5
    ssh version 2
    console timeout 0
    dhcpd option 6 ip 8.8.8.8 8.8.4.4
    dhcpd address 10.4.0.15-10.4.0.245 inside
    dhcpd dns 8.8.8.8 8.8.4.4 interface inside
    dhcpd lease 86400 interface inside
    dhcpd option 3 ip 10.4.0.1 interface inside
    dhcpd enable inside
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    webvpn
    enable outside
    svc image disk0:/anyconnect-win-2.5.3055-k9.pkg 1
    svc image disk0:/anyconnect-macosx-i386-2.5.3055-k9.pkg 2
    svc enable
    tunnel-group-list enable
    group-policy SSLVPN internal
    group-policy SSLVPN attributes
    dns-server value 8.8.8.8 8.8.4.4
    vpn-tunnel-protocol svc
    group-lock none
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value inside_split_tunnel
    vlan none
    address-pools value SSLVPNPool2
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    username user1 password
    username user1 attributes
    service-type remote-access
    username user2 password
    tunnel-group SSLVPNGROUP type remote-access
    tunnel-group SSLVPNGROUP general-attributes
    address-pool SSLVPNPool2
    default-group-policy SSLVPN
    tunnel-group SSLVPNGROUP webvpn-attributes
    group-alias SSLVPN enable
    prompt hostname context
    Cryptochecksum:3b16cbc9bbdfa20e6987857c1916a396
    : end
    Thank in advance for any help!

    Your config actually looks good (you have the ACL that would allow the echo-reply back since you don't have inspection turned on) - are you sure this isn't a windows firewall issue on the PCs?  I'd try pinging a router or switch just to make sure.
    --Jason

  • Cisco AnyConnect VPN client and 256 AES encryption in IE8

    Hey,
    We have a site that we are trying to connect to with the AnyConnect VPN client version 2.5.3055 on Windows XP SP3. As soon as we enter the site info and hit select, it says a connection was unable to be established.
    I believe this has to do with the encryption, its set up with 256 bit AES. We are only able to install IE8, which on XP only supports up to 128 bit encryption, so in IE8 the page will not load. To fix that issue we installed firefox which supports 256 bit encryption. We can get to the page there, but when we go to connect to the same site VIA the VPN client it still will not connect. It will work fine on a windows 7 box with IE9 installed from the same network.
    My question mainly pertains to how the AnyConnect client connects on the back end. Does it use Internet explorer's SSL layer by default? Or does it have its own? If it connects through internet explorer, is there a way to change it to firefox so it will actually be able to open up a connection?
    Thank you for your answers in advance,
    John

    Hey Jeff,
    Thanks for answering that question. Hmm, so it doesnt go through the browsers SSL layer. We have systems on the same network (same proxy, firewall, vlan, etc). All the systems with windows XP SP3 and IE8/IE7 can not connect to the VPN (they arent even able to start the connection and ask for proxy/logon info.), all the systems with windows 7 and IE9 can. Same setups on each one as far as the security policies go as well. I thought it may have to do with the 256 bit encryption that they are using.
    If thats not the case, what else could be causing the problem? weve tested it on about 5 XP machines and 5 Win 7 machines, same results on each. Connects on Win 7, does not connect on Win XP.
    Thanks,
    John

  • Communication problem from the vpn-anyconnect to easy-vpn-remote

    Hi Team,
    I have a communication problem from the vpn-anyconnect to easy-vpn-remote, I´ll explain better bellow and see the attached
    topology:
    1) VPN Tunnel between HQ to Branch Office - That´s OK
    2) VPN Tunnel between Client AnyConnect to HQ - That´s OK
    The idea is that the Client Anyconnect is to reach the LAN at Branch Office, but did not reach.
    The communication is stablished just when I start a session (icmp and/or rdp) from Branch Office to the Client AnyConnect,
    in this way, the communication is OK, but just during a few minutes.
    Could you help me?
    Bellow the IOS version and configurations
    ASA5505 Version 8.4(7)23 (headquarters)
    ASA5505 Version 8.4(7)23 (Branch)
    **************** Configuration Easy VPN Server (HQ) **************** 
    crypto dynamic-map DYNAMIC-MAP 5 set ikev1 transform-set ESP-AES-256-SHA
    crypto map outside-link-2_map 1 ipsec-isakmp dynamic DYNAMIC-MAP
    crypto map outside-link-2_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside-link-2_map interface outside-link-2
    access-list ACL_EZVPN standard permit 10.0.0.0 255.255.255.0 
    access-list ACL_EZVPN standard permit 192.168.1.0 255.255.255.0 
    access-list ACL_EZVPN standard permit 192.168.50.0 255.255.255.0 
    access-list ACL_EZVPN standard permit 10.10.0.0 255.255.255.0 
    group-policy EZVPN_GP internal
    group-policy EZVPN_GP attributes
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value ACL_EZVPN
     nem enable 
    tunnel-group EZVPN_TG type remote-access
    tunnel-group EZVPN_TG general-attributes
     default-group-policy EZVPN_GP
    tunnel-group EZVPN_TG ipsec-attributes
     ikev1 pre-shared-key *****
    object-group network Obj_VPN_anyconnect-local
     network-object 192.168.1.0 255.255.255.0
     network-object 192.168.15.0 255.255.255.0
    object-group network Obj-VPN-anyconnect-remote
     network-object 192.168.50.0 255.255.255.0
    object-group network NAT_EZVPN_Source
     network-object 192.168.1.0 255.255.255.0
     network-object 10.10.0.0 255.255.255.0
    object-group network NAT_EZVPN_Destination
     network-object 10.0.0.0 255.255.255.0
    nat (inside,outside-link-2) source static Obj_VPN_anyconnect-local Obj_VPN_anyconnect-local destination static Obj-VPN-
    anyconnect-remote Obj-VPN-anyconnect-remote no-proxy-arp route-lookup
    nat (inside,outside-link-2) source static NAT_EZVPN_Source NAT_EZVPN_Source destination static NAT_EZVPN_Destination 
    NAT_EZVPN_Destination no-proxy-arp route-lookup
    nat (outside-link-2,outside-link-2) source static Obj-VPN-anyconnect-remote Obj-VPN-anyconnect-remote destination static 
    NAT_EZVPN_Destination NAT_EZVPN_Destination no-proxy-arp route-lookup
    **************** Configuration VPN AnyConnect (HQ) **************** 
    webvpn
     enable outside-link-2
     default-idle-timeout 60
     anyconnect-essentials
     anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
     anyconnect profiles Remote_Connection_for_TS_Users disk0:/remote_connection_for_ts_users.xml
     anyconnect enable
     tunnel-group-list enable
    access-list split-tunnel standard permit 192.168.1.0 255.255.255.0 
    access-list split-tunnel standard permit 192.168.15.0 255.255.255.0 
    access-list split-tunnel standard permit 10.0.0.0 255.255.255.0 
    group-policy clientgroup internal
    group-policy clientgroup attributes
     wins-server none
     dns-server value 192.168.1.41
     vpn-tunnel-protocol ssl-client 
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value split-tunnel
     default-domain value ipconnection.com.br
     webvpn       
      anyconnect keep-installer installed
      anyconnect ssl rekey time 30
      anyconnect ssl rekey method ssl
      anyconnect profiles value Remote_Connection_for_TS_Users type user
      anyconnect ask none default anyconnect
    tunnel-group sslgroup type remote-access
    tunnel-group sslgroup general-attributes
     address-pool vpnpool
     authentication-server-group DC03
     default-group-policy clientgroup
    tunnel-group sslgroup webvpn-attributes
     group-alias IPConnection-vpn-anyconnect enable
    object-group network Obj_VPN_anyconnect-local
     network-object 192.168.1.0 255.255.255.0
     network-object 192.168.15.0 255.255.255.0
    object-group network Obj-VPN-anyconnect-remote
     network-object 192.168.50.0 255.255.255.0
    object-group network NAT_EZVPN_Source
     network-object 192.168.1.0 255.255.255.0
     network-object 10.10.0.0 255.255.255.0
    object-group network NAT_EZVPN_Destination
     network-object 10.0.0.0 255.255.255.0
    nat (inside,outside-link-2) source static Obj_VPN_anyconnect-local Obj_VPN_anyconnect-local destination static Obj-VPN-
    anyconnect-remote Obj-VPN-anyconnect-remote no-proxy-arp route-lookup
    nat (inside,outside-link-2) source static NAT_EZVPN_Source NAT_EZVPN_Source destination static NAT_EZVPN_Destination 
    NAT_EZVPN_Destination no-proxy-arp route-lookup
    nat (outside-link-2,outside-link-2) source static Obj-VPN-anyconnect-remote Obj-VPN-anyconnect-remote destination static 
    NAT_EZVPN_Destination NAT_EZVPN_Destination no-proxy-arp route-lookup

    Hi,
    the communication works when you send traffic from easyvpn branch side because it froms the IPSEC SA for local subnet and anyconnect HQ pool. The SA will only form when branch initiates the connection as this is dynamic peer connection to HQ ASA.
    when there no SA between branch and HQ for this traffic, HQ ASA has no clue about where to send the traffic from anyconnect to branch network.
    I hope it explains the cause.
    Regards,
    Abaji.

  • SSL VPN Webauth/anyconnect failue

    So with our setup we're using the SSL webauth page as it uses RSA Adaptive Authentication as the second factor for auth. In the DAP we then push the connection over to anyconnect. The result is this.
    1. Webauth to AD
    2. RSA auth with questions
    3. DAP match
    4. Anyconnect verification/download/upgrade/connect
    At the 4th stage the anyconnect downloader completes all the apropriate checks for install, version upgrade, and then connect.
    We have a user with a windows 7 machine that's failing on this 4th step. I've watched the 1st three phases succeed each time and then when it comes time for the 4th step there's no indication of an issue. The webpage just defaults back to the login page with no error or any information as to what occured or didn't occur.
    In the logs I see the following
    - Primary auth pass
    - Secondary auth pass
    - DAP match success
    - Unknown logs
    Below is what I see in the logs for the issue user and my session
    Jan 10 2013 17:51:00: %ASA-6-734001: DAP: user issueuser, Addr x.x.x.x, Connection Clientless: The following DAP records were selected for this connection: xxx
    Jan 10 2013 17:51:00: %ASA-7-720041: (VPN-Primary) Sending Create RAMFS message change path sessions/27017216/user:issueuser to standby unit
    Jan 10 2013 17:51:00: %ASA-6-716001: Group <company> user <issueuser> IP <x.x.x.x> WebVPN session started.
    Jan 10 2013 17:51:00: %ASA-7-720041: (VPN-Primary) Sending Create WebVPN Session message user issueuser, IP x.x.x.x to standby unit
    Jan 10 2013 17:51:00: %ASA-6-716038: Group <company> user <issueuser> IP <x.x.x.x> Authentication: successful, Session Type: WebVPN.
    Jan 10 2013 18:21:25: %ASA-7-720041: (VPN-Primary) Sending Delete WebVPN Session message user issueuser, IP x.x.x.x to standby unit
    Jan 10 2013 18:21:25: %ASA-6-716002: Group <company> user <issueuser> IP <x.x.x.x> WebVPN session terminated: Idle Timeout.
    Jan 10 2013 20:12:50: %ASA-6-734001: DAP: user mysession, Addr x.x.x.x, Connection Clientless: The following DAP records were selected for this connection: company-Non-Owned
    Jan 10 2013 20:13:06: %ASA-4-722041: TunnelGroup <company> GroupPolicy <company> issueuser <mysession> IP <x.x.x.x> No IPv6 address available for SVC connection
    Jan 10 2013 20:13:06: %ASA-5-722033: Group <company> user <mysession> IP <x.x.x.x> First TCP SVC connection established for SVC session.
    Jan 10 2013 20:13:06: %ASA-6-722022: Group <company> user <mysession> IP <x.x.x.x> TCP SVC connection established without compression
    Jan 10 2013 20:13:06: %ASA-7-746012: issueuser-identity: Add IP-user mapping x.x.x.x - LOCAL\mysession Succeeded - VPN user
    Jan 10 2013 20:13:06: %ASA-7-746012: issueuser-identity: Add IP-user mapping session.ip.address - LOCAL\mysession Succeeded - VPN user
    Jan 10 2013 20:13:06: %ASA-4-722051: Group <company> user <mysession> IP <x.x.x.x> Address <session.ip.address> assigned to session
    Thanks for any help and/or suggestions.

    Agree with Andrew, DG is something you cannot change as it is virtualy assigned, unless indicated by Andrew.
    Where is the tunnel terminated at inside, outside interfaces? I suspect you are probably using Webvpn Pool IP range scheme as an already used subnet from inside where your DC resides, if this is the case use a different private IP network for WebVPN tunnel group.
    HTH
    Jorge

Maybe you are looking for

  • Ipad, filing, folders, opening a document with more than one app...

    Hi I am wondering about iPad filing, documents and the future that iOS 5 and iCloud hold. Am I right in thinking that there will still be no file/folder structure and that documents will be held individually by apps? This creates two problems for me:

  • How to track cartons in Warehouse

    Hi All       1. Our client is placing material in cartons and after palletilization it is placed in a avialable storage bin, for each pallet there will be 10 or 12 cartons will be placed , their requirement is that they have to track the carton some

  • Problems managing Messages in ios 8

    My wife is using an iPhone 5C 32Gb, running iOS 8.1.  Apart from calling, she uses her iPhone primarily for Mail and Messages.  She likes to keep those apps clean, so she is constantly deleting unwanted messages, etc.. Ever since we upgraded to iOS 8

  • Hkey_local_machine32\software\classes\iTunes.aa\CurVer

    does anyone knows how to solve this problem ??!?!?!?!??!?!?!?!

  • IPsec tunnel to a windows 2008 R2 server

    I have an application that uses FTP to a win2k8r2 server. I'd like to setup an IPSEC tunnel to the windows server to encapsulate this traffic. I've configured IPSEC in Solaris before, but not in LINUX. The implementation eludes me. I've searched onli