Unable to access inside network using Split tunnel RA VPN

Question

Hi Everyone,
I configured RA Split tunnel VPN.
Connection works fine.
Inside Interface of ASA has connection to Switch IP 10.1.12.1.
When connected via RA VPN i try https://10.1.12.1 but it does not open up.
Inside Interface of ASA has IP 10.0.0.1
ASA1#                                                                         $
Session Type: IKEv1 IPsec Detailed
Username     : ipsec-user             Index        : 23
Assigned IP  : 10.0.0.51              Public IP    : 192.168.98.2
Protocol     : IKEv1 IPsec
License      : Other VPN
Encryption   : IKEv1: (1)AES256  IPsec: (1)AES128
Hashing      : IKEv1: (1)SHA1  IPsec: (1)SHA1
Bytes Tx     : 2130969                Bytes Rx     : 259008
Pkts Tx      : 6562                   Pkts Rx      : 3682
Pkts Tx Drop : 0                      Pkts Rx Drop : 0
Group Policy : ipsec-group            Tunnel Group : ipsec-group
Login Time   : 11:10:41 MST Sun Jan 26 2014
Duration     : 0h:40m:30s
Inactivity   : 0h:00m:00s
NAC Result   : Unknown
VLAN Mapping : N/A                    VLAN         : none
IKEv1 Tunnels: 1
IPsec Tunnels: 1
IKEv1:
  Tunnel ID    : 23.1
  UDP Src Port : 62751                  UDP Dst Port : 500
  IKE Neg Mode : Aggressive             Auth Mode    : preSharedKeys
  Encryption   : AES256                 Hashing      : SHA1
  Rekey Int (T): 86400 Seconds          Rekey Left(T): 83975 Seconds
  D/H Group    : 2
  Filter Name  :
  Client OS    : WinNT                  Client OS Ver: 5.0.07.0440
IPsec:
  Tunnel ID    : 23.2
  Local Addr   : 0.0.0.0/0.0.0.0/0/0
  Remote Addr  : 10.0.0.51/255.255.255.255/0/0
  Encryption   : AES128                 Hashing      : SHA1
  Encapsulation: Tunnel
  Rekey Int (T): 28800 Seconds          Rekey Left(T): 26375 Seconds
  Idle Time Out: 30 Minutes             Idle TO Left : 29 Minutes
  Bytes Tx     : 2137160                Bytes Rx     : 259088
  Pkts Tx      : 6571                   Pkts Rx      : 3684
NAC:
  Reval Int (T): 0 Seconds              Reval Left(T): 0 Seconds
  SQ Int (T)   : 0 Seconds              EoU Age(T)   : 2426 Seconds
  Hold Left (T): 0 Seconds              Posture Token:
  Redirect URL :
From ASA i can ping the switch IP
ASA1#  ping 10.1.12.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.12.1, timeout is 2 seconds:
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms
ASA1#
logs from firewall
Jan 26 2014 11:53:20: %ASA-6-302014: Teardown TCP connection 51636 for outside:10.0.0.51/50747(LOCAL\ipsec-user) to identity:10.0.0.1/443 duration 0:00:00 bytes 1075 TCP Reset-O (ipsec-user)
Jan 26 2014 11:53:20: %ASA-6-106015: Deny TCP (no connection) from 10.0.0.51/50747 to 10.0.0.1/443 flags FIN ACK  on interface outside
Why firewall logs show https connection to 10.0.0.1 instead of  10.1.12.1?
Regards
Mahesh

Answer 1

Hi Jouni,
ASA1# sh ip address
System IP Addresses:
Interface                Name                   IP address      Subnet mask     Method
Vlan1                    inside                 10.0.0.1        255.255.255.0   CONFIG
Vlan2                    outside                192.168.1.171   255.255.255.0   CONFIG
Vlan3                    sales                  10.12.12.1      255.255.255.0   CONFIG
Current IP Addresses:
Interface                Name                   IP address      Subnet mask     Method
Vlan1                    inside                 10.0.0.1        255.255.255.0   CONFIG
Vlan2                    outside                192.168.1.171   255.255.255.0   CONFIG
Vlan3                    sales                  10.12.12.1      255.255.255.0   CONFIG
Connection is split tunnel.
when i check stats on vpn client all i see bypassed packets.
ASA1#                                                       sh run group-polic$
group-policy ipsec-group internal
group-policy ipsec-group attributes
dns-server value 64.59.144.19
vpn-tunnel-protocol ikev1
split-tunnel-policy tunnelspecified
ipv6-split-tunnel-policy excludespecified
split-tunnel-network-list value ipsec-group_splitTunnelAcl
Regards
Mahesh
Message was edited by: mahesh parmar