Cisco ASA – AnyConnect VPN Not Able to Access Remote LAN

ciscocisco-anyconnectcisco-asavpn

I have setup ASA5506 for cisco anyconnect VPN and i am able to connect VPN but not able to ping or ssh or anything to any device on remote lan (inside) network 10.0.10.x/24

Here is the network diagram:

Configuration:

ASA Version 9.8(2)
!
hostname asa0
enable password <secret>
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
names
ip local pool ANYCONNECT-POOL 10.0.11.1-10.0.11.254 mask 255.255.255.0

!
interface GigabitEthernet1/1
 nameif inside
 security-level 100
 ip address 10.0.10.1 255.255.255.0
!
interface GigabitEthernet1/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/6
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/7
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/8
 description Internet-ISP
 nameif outside
 security-level 0
 ip address 71.100.102.210 255.255.255.0
!
interface Management1/1
 management-only
 shutdown
 no nameif
 security-level 100
 no ip address
!
boot system disk0:/asa982-lfbff-k8.SPA
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup inside
dns server-group DefaultDNS
 name-server 10.0.10.10
 name-server 10.0.10.11
object network VPN-ANYCONNECT-SUBNET
 subnet 10.0.11.0 255.255.255.0
object-group network NET-SITE0-SUBNETS
 network-object 10.0.10.0 255.255.255.0
 network-object 10.0.11.0 255.255.255.0
object-group network NET-VPN-POOL
 network-object 10.0.11.0 255.255.255.0
access-list ANYCONNECT-ROUTES-FOO-EMPLOYEE standard permit 10.0.0.0 255.0.0.0
access-list OUTSIDE_IN extended permit icmp any any
pager lines 24
logging enable
logging timestamp
logging buffer-size 16384
logging buffered informational
logging asdm errors
mtu inside 1500
mtu outside 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 10 burst-size 5
icmp permit any outside
asdm image disk0:/asdm-741.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 32768
nat (any,outside) source static NET-VPN-POOL NET-VPN-POOL destination static NET-SITE0-SUBNETS NET-SITE0-SUBNETS
!
nat (any,outside) after-auto source dynamic NET-SITE0-SUBNETS interface
access-group OUTSIDE_IN in interface outside
route outside 0.0.0.0 0.0.0.0 71.100.102.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:01:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication login-history
http server enable
no snmp-server location
no snmp-server contact
sysopt connection tcpmss 1379
service sw-reset-button
crypto ca trustpoint FOO_Wildcard_2016
 keypair FOO_Wildcard_2016
 crl configure
crypto ca trustpoint CA_Bundle
 enrollment terminal
 crl configure
crypto ca trustpool policy
crypto ca certificate chain FOO_Wildcard_2016
 certificate 25e70b9d51d92b2c
    3082051c 30820404 a0030201 02020825 e70b9d51 d92b2c30 0d06092a 864886f7
    …
   <output omitted>
    …
    469628ad a1267d0a 09a72e04 a38dbcf8 bc043001
  quit
telnet timeout 5
ssh stricthostkeycheck
ssh 10.0.0.0 255.0.0.0 inside
ssh timeout 15
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
management-access inside

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point FOO_Wildcard outside
webvpn
 enable outside
 anyconnect image disk0:/anyconnect-win-4.5.01044-webdeploy-k9.pkg 1
 anyconnect image disk0:/anyconnect-macos-4.5.01044-webdeploy-k9.pkg 2
 anyconnect image disk0:/anyconnect-linux64-4.5.01044-webdeploy-k9.pkg 3
 anyconnect enable
 tunnel-group-list enable
 cache
  disable
 error-recovery disable
group-policy GroupPolicy_ANYCONNECT-FOO-EMPLOYEE internal
group-policy GroupPolicy_ANYCONNECT-FOO-EMPLOYEE attributes
 dns-server value 10.0.10.1 10.0.10.10
 vpn-tunnel-protocol ssl-client
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value ANYCONNECT-ROUTES-FOO-EMPLOYEE
 default-domain value FOO.com
dynamic-access-policy-record DfltAccessPolicy
tunnel-group FOO-EMPLOYEE type remote-access
tunnel-group FOO-EMPLOYEE general-attributes
 address-pool ANYCONNECT-POOL
 default-group-policy GroupPolicy_ANYCONNECT-FOO-EMPLOYEE
tunnel-group FOO-EMPLOYEE webvpn-attributes
 group-alias FOO-EMPLOYEE enable
!
class-map inspection_default
 match default-inspection-traffic
class-map NOTIMEOUT_class
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
policy-map global_policy
 class inspection_default
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
  inspect dns preset_dns_map
  inspect icmp
policy-map type inspect dns migrated_dns_map_1
 parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
!
service-policy global_policy global
prompt hostname context
: end

Best Answer

Solution

Nevermind i figured it out, it was nat rule missing (inside,outside)

nat (inside,outside) source static any any destination static NET-VPN-POOL NET-VPN-POOL no-proxy-arp route-lookup

Your ASA configuration:

route outside 0.0.0.0 0.0.0.0 172.16.1.1 1

This will provide a default route via the outside interface, but how will the ASA know how to reach subnets residing behind the Layer 3 Distribution Switch?

You'll need to add routes to the internal subnets via the inside interface using the Layer 3 Distribution Switch as the next-hop IP address.

ASA static routing example:

route inside 172.19.12.0 255.255.255.240 172.16.2.2
route inside 172.19.3.0 255.255.255.0 172.16.2.2
route inside 172.20.100.0 255.255.255.224 172.16.2.2

Your Cisco Router's configuration:

ip route 0.0.0.0 0.0.0.0 200.200.200.200

Additionally, how will your border router know how to reach subnets other than it's connected routes, and the catch all default route via the outside interface's next-hop address 200.200.200.200?

Router static routing example:

ip route 172.19.12.0 255.255.255.240 172.16.1.10
ip route 172.19.3.0 255.255.255.0 172.16.1.10
ip route 172.19.100.0 255.255.255.224 172.16.1.10
ip route 172.16.2.0 255.255.255.224 172.16.1.10

Switchport BPDUs Dropped at ASA Firewall – Troubleshooting

If you can be sure of your cabling then I would recommend implementing spanning-tree bpdufilter on the interface towards the firewall since you have already configured the interface as an edge port. This does not provide any loop protection, but the ASA (non-5505 as indicated) is incapable of creating a L2 loop and your stated goal is to remove BPDU's from the interface.

Configuring root-guard on the interface will not be useful since the ASA can never send any BPDU, and especially not a superior BPDU. If you do not choose to configure BPDU filtering, then BPDU-Guard should be configured either by default (spanning-tree portfast bpduguard default) or specifically on the interface. This will prevent any other spanning-tree capable device from being connected to that interface.

Further, if you do not have an untagged (native) interface on the firewall, allowing the native vlan on the trunk is not required and your allowed vlan list could be shortened to exclude 99. Also you could set the interface to not negotiate the access/trunking mode with switchport nonegotiate and remove the configured access vlan.