Vpn – ASA 5510 AnyConnect SSL VPN to Windows 3.1 client – connected but no traffic routed

cisco-anyconnectcisco-asasslvpnvpn

ASA version 9.1 configured with SSL VPN to Windows AnyConnect Secure Mobility Client version 3.1. VPN Filter ACL is configured to allow all traffic and ICMP, and is attached to group policy.

Problem:

VPN connects successfully (AnyConnect client says "connected") but cannot route any traffic over the VPN. Cannot ping any internal host behind the ASA,

Observations:

Internal network (behind ASA): 10.111.11.0/24
Network on client computer: 192.168.1.0/24 (sits behind another ASA – that is not relevant though because doesn't work on other n/w having no ASA firewall either)

ASDM reports one AnyConnect session active on the ASA. Reports also that the above ACL is going to be used. The first rule of that ACL (see below config) got 1900 hits so traffic arrives but seems to not find its way back? VPN ACLs are meant to automatically be bidirectional so it SHOULD work.

On the Windows client computer I can see a Cisco network adapter has been created when the VPN connects with IP address 192.168.20.1. Network configuration claims that 192.168.20.2 is the default gateway, which should be the ASA – but I cannot ping 192.168.20.2.
A "route print" on the client computer shows 192.168.20.2 to be the default gateway as well.
(These addresses are valid – they are assigned from local pool RemoteWorkerPool 192.168.20.1-192.168.20.254, see below config).

I cannot ping the client IP address (192.168.20.1) from within the ASA (does the AnyConnect client respond to the ping usually?)

Running a "show vpn-sessiondb detail svc filter name " command shows "Filter name: RemoteVPNACL" in the SSL section, which fits to my configuration – the ACL is being used.

SSL Ciphers:

A "show ssl" command brings up the following:

Accept connections using SSLv2, SSLv3 or TLSv1 and negotiate to SSLv3 or TLSv1
Start connections using SSLv3 and negotiate to SSLv3 or TLSv1
Enabled cipher order: rc4-sha1 dhe-aes128-sha1 dhe-aes256-sha1 aes128-sha1 aes256-sha1 3des-sha1
Disabled ciphers: des-sha1 rc4-md5 null-sha1
SSL trust-points:
  outside interface: TrustPoint1
  NP Identity Ifc interface:
Certificate authentication is not enabled

This also seems okay – I use username / password authentication. I could not find anything in Cisco documentation that the 3.1 client would not work with ASA version 9.1, but it's not 100% clear.

Solution Attempts:

Configuration was originally created by ASDM wizard and resulted in this problem. Have re-created the configuration plainly from CLI, same result.

Connected the Windows client to another internet connection which is not behind any firewall. Same result – VPN connects but no traffic can flow.

Have configured IPSec VPN for AnyConnect on top of this configuration – same result, I get a connection, but no traffic flows.

The Cisco VPN troubleshooter did not give me any useful hint.

I am sure there is a very basic error somehwere, but cannot find it. I am lacking knowledge on how one goes about debugging or troubleshooting AnyConnect VPN connections apart from above.

Configuration (relevant parts):


crypto key generate rsa label RSA_KEYPAIR noconfirm

crypto ca trustpoint TrustPoint1
   revocation-check none
   id-usage ssl-ipsec
   no fqdn
   subject-name CN=ASA
   enrollment self
   keypair RSA_KEYPAIR

crypto ca enroll TrustPoint1 noconfirm
ssl trust-point TrustPoint1 outside

ip local pool RemoteWorkerPool 192.168.20.1-192.168.20.254

sysopt connection permit-vpn 

access-list RemoteVPNACL permit ip 192.168.20.0 255.255.255.0 any 
access-list RemoteVPNACL permit icmp 192.168.20.0 255.255.255.0 any 

group-policy RemoteWorkerPolicy internal
group-policy RemoteWorkerPolicy attributes
  vpn-tunnel-protocol ssl-client
  address-pools value RemoteWorkerPool
  vpn-filter value RemoteVPNACL
  dns-server value 10.111.11.5
  vpn-idle-timeout 30

username nepclientvpn password xxxxxxxxxxxxx
username nepclientvpn attributes
  vpn-group-policy RemoteWorkerPolicy

tunnel-group vpnclient type remote-access   

tunnel-group vpnclient general-attributes
  address-pool RemoteWorkerPool
  default-group-policy RemoteWorkerPolicy

tunnel-group vpnclient webvpn-attributes
  group-alias nepRemote1 enable 

webvpn
  tunnel-group-list enable 
  anyconnect image disk0:/anyconnect-win-3.1.05182-k9.pkg 1
  anyconnect image disk0:/anyconnect-macosx-i386-3.1.05160-k9.pkg 2
  enable outside
  anyconnect enable

Best Answer

If both sides indicate that there is a security association established, then it's like the encryption is working and there is some other problem.

One thing to check out is what is the default gateway for the machines that are on the LAN and do they have a way to route packets to 192.168.1.0/24.

Related Topic