Cisco Anyconnect Vpn Port

To verify split tunnel configuration from remote PC, open AnyConnect VPN icon in task tray, then select: Statistics Details Route Details AnyConnect VPN Client ' Local LAN Access (Split Tunnel Variant) In this example, only traffic to the Local PC LAN (192.168.100.0/24) is sent in clear (no VPN). All other traffic is sent encrypted over.

Introduction

  1. !Before starting the actual configuration of Web Vpn, first we configure Gateway, on which IP address we shall terminate the Anyconnect VPN, which certificates to use, on which port we shall run the VPN and any redirections necessary ( i.e. If request comes on port 80 port, it will redirect the user to port 443).
  2. It is important to understand the ports used for the different methods to ensure that those ports are not blocked. NAT Traversal – This method still uses 500/udp for IKE negotiation, but then tunnels IPSec data traffic within 4500/udp packets. This is the default method for UDP tunneling with the Cisco VPN client.

This document describes how to troubleshoot some of the most common communication issues of the Cisco AnyConnect Secure Mobility Client on Firepower Threat Defense (FTD) when it uses either Secure Socket Layer (SSL) or Internet Key Exchange version 2 (IKEv2).

Contributed by Angel Ortiz and Fernando Jimenez, Cisco TAC Engineers.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

  • Cisco AnyConnect Secure Mobility Client.
  • Cisco FTD.
  • Cisco Firepower Management Center (FMC).

Components Used

The information in this document is based on these software and hardware versions:

  • FTD managed by FMC 6.4.0.
  • AnyConnect 4.8.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Recommended troubleshoot process

This guide explains how to troubleshoot some common communication issues that AnyConnect clients have when the FTD is used as Remote Access Virtual Private Network (VPN) gateway. These sections address and provide solutions to problems below:

  • AnyConnect clients cannot access internal resources.
  • AnyConnect clients do not have internet access.
  • AnyConnect clients cannot communicate between each other.
  • AnyConnect clients cannot establish phone calls.
  • AnyConnect clients can establish phone calls. However, there is no audio on the calls.

AnyConnect clients cannot access internal resources

Complete these steps:

Step 1. Verify Split tunnel configuration.

  • Navigate to the Connection Profile that AnyConnect clients are connected to: Devices > VPN > Remote Access > Connection Profile > Select the Profile.
  • Navigate to the Group-Policy assigned to that Profile: Edit Group Policy > General.
  • Check the Split Tunneling configuration, as shown in the image.
  • If it's configured as Tunnel networks specified below, verify the Access Control List (ACL) configuration:

Navigate to Objects > Object Management > Access List > Edit the Access List for Split tunneling.

Cisco Anyconnect Vpn Port
  • Ensure that the networks that you try to reach from the AnyConnect VPN client are listed in that Access List, as shown in the image.

Step 2.Verify Network Address Translation (NAT) exemption configuration.

Remember that we must configure a NAT exemption rule to avoid traffic to be translated to the interface IP address, usually configured for internet access (with Port Address Translation (PAT)).

  • Navigate to the NAT configuration: Devices > NAT.
  • Ensure that the NAT exemption rule is configured for the correct source (internal) and destination (AnyConnect VPN Pool) networks. Also check that the correct source and destination interfaces have been selected, as shown in the image.

Note: When NAT exemption rules are configured, check the no-proxy-arp and perform route-lookup options as a best practice.


Step 3. Verify Access Control Policy.

Per your Access Control Policy configuration, ensure that traffic from the AnyConnect clients is allowed to reach the selected internal networks, as shown in the image.

AnyConnect clients do not have internet access

There are two possible scenarios for this issue.

  1. Traffic destined for the internet must not go through the VPN tunnel.

Ensure that the Group-Policy is configured for Split tunneling as Tunnel networks specifiedbelow and NOT as Allow all traffic over tunnel, as shown in the image.

2. Traffic destined for the Internet must go through the VPN tunnel.

In this case, the most common Group-Policy configuration for Split tunneling would be to select Allow all traffic over tunnel, as shown in the image.

Step 1. Verify NAT exemption configuration for internal network reachability.

Remember that we must still configure a NAT exemption rule to have access to the internal network. Please review Step 2 of the AnyConnect clients cannot access internal resource section.

Step 2. Verify hairpinning configuration for dynamic translations.

In order for AnyConnect clients to have internet access through the VPN tunnel, we need to ensure that the hairpinning NAT configuration is correct for traffic to be translated to the interface´s IP address.

  • Navigate to the NAT configuration: Devices > NAT.
  • Ensure that the Dynamic NAT rule is configured for the correct interface (Internet Service Provider (ISP) link) as source and destination (hairpinning). Also check that the network used for the AnyConnect VPN address pool is selected in Original source and the Destination Interface IP option is selected for Translated source, as shown in the image.


Step 3. Verify Access Control Policy.

Per your Access Control Policy configuration, ensure that traffic from the AnyConnect clients is allowed to reach the external resources, as shown in the image.

AnyConnect clients cannot communicate between each other

There are two possible scenarios for this issue:

  1. AnyConnect clients with Allow all traffic over tunnel configuration in place.
  2. AnyConnect clients with Tunnel networks specified below configuration in place.

Cisco Anyconnect Vpn Web Portal

  1. AnyConnect clients with Allow all traffic over tunnel configuration in place.

When Allow all traffic over tunnel is configured for AnyConnect means that all traffic, internal and external, should be forwarded to the AnyConnect headend, this becomes a problem when you have NAT for Public Internet access, since traffic comes from an AnyConnect client destined to another AnyConnect client is translated to the interface IP address and therefore communication fails.

Step 1. Verify NAT exemption configuration.

In order to overcome this problem a manual NAT exemption rule must be configured to allow bidirectional communication within the AnyConnect clients.

  • Navigate to the NAT configuration: Devices > NAT.
  • Ensure that the NAT exemption rule is configured for the correct source (AnyConnect VPN Pool) and destination. (AnyConnect VPN Pool) networks. Also check that the correct hairpin configuration is in place, as shown in the image.

Step 2. Verify Access Control Policy.

Per your Access Control Policy configuration, ensure that traffic from the AnyConnect Clients is allowed, as shown in the image.

2. Anyconnect clients with Tunnel networks specified below configuration in place.

With Tunnel networks specified below configured for the AnyConnect clients only specific traffic is forwarded to through the VPN tunnel. However, we need to ensure that the headend has the proper configuration to allow communication within the AnyConnect clients.

Step 1. Verify NAT exemption configuration.

Please check Step 1, in the Allow all traffic over tunnel section.

Step 2. Verify Split tunneling configuration.

For AnyConnect clients to communicate between them we need to add the VPN pool addresses into the Split-Tunnel ACL.

  • Please follow Step 1 of the AnyConnect clients cannot access internal resources section.
  • Ensure that the AnyConnect VPN Pool network is listed in the Split tunneling Access List, as shown in the image.

Note: If there is more than one IP Pool for AnyConnect clients and communication between the different pools is needed, ensure to add all of the pools in the split tunneling ACL, also add a NAT exemption rule for the needed IP Pools.

Step 3. Verify Access Control Policy.

Ensure that traffic from the AnyConnect clients is allowed as shown in the image.

AnyConnect clients cannot establish phone calls

There are some scenarios where AnyConnect clients need to establish phone calls and video conferences over VPN.

AnyConnect clients can connect to the AnyConnect headend without any problem. They can reach internal and external resources, however phone calls cannot be established.

For this cases we need to consider the follow points:

  • Network topology for voice.
  • Protocols involved. I.e. Session Initiation Protocol (SIP), Rapid Spanning Tree Protocol (RSTP), etc.
  • How the VPN phones connect to the Cisco Unified Communications Manager (CUCM).

By default, FTD and ASA have applications inspection enabled by default in their global policy-map.

In most cases scenarios the VPN phones are not able to establish a reliable communication with the CUCM because the AnyConnect headend has an application inspection enabled that modifies the signal and voice traffic.

For more information about the voice and video application where you can apply application inspection see the follow document:

In order to confirm if an application traffic is dropped or modified by the global policy-map we can use the show service-policy command as shown below.


In this case we can see how SIP inspection drops the traffic.


Moreover, SIP inspection can also translate IP addresses inside the payload, not in the IP header, causes different issues, hence it is recommended to disable it when we want to use voice services over AnyConnect VPN.

In order to disable it we need to complete the next steps:

Step 1. Enter the privileged EXEC mode.

For more information on how to access this mode see the next document:

Step 2. Verify the global policy-map.

Run the next command and verify if SIP inspection is enabled.

Step 3. Disable SIP inspection.

If SIP inspection is enabled, turn it off running command below from clish prompt:

Step 4. Verify the Global Policy-map again.

Ensure that SIP inspection is disabled from the global policy-map:

AnyConnect clients can establish phone calls, however there is no audio on the calls

As mentioned in the previous section, a very common need for AnyConnect clients is to establish phone calls when connected to the VPN. In some cases the call can be established, however clients may experience lack of audio on it. This applies to the next scenarios:

  • No audio on the call between an AnyConnect client and an external number.
  • No audio on the call between an AnyConnect client and another AnyConnect client.

Cisco Anyconnect Vpn Port Forwarding

In order to get this fixed, we can follow these steps:

Step 1. Verify Split tunneling configuration.

    • Navigate to the Connection Profile use to connect to: Devices > VPN > Remote Access > Connection Profile > Select the Profile.
    • Navigate to the Group-Policy assigned to that Profile: Edit Group Policy > General.
    • Check the Split Tunneling configuration, as shown in the image.
    • If configured as Tunnel networks specified below, verify the Access List configuration: Objects > Object Management > Access List > Edit the Access List for Split tunneling.
    • Ensure that the Voice Servers and the AnyConnect IP Pool networks are listed in the Split tunneling Access List, as shown in the image.

Cisco Anyconnect Port Forwarding

Step 2. Verify NAT exemption configuration.

NAT exemption rules must be configured to exempt traffic from the AnyConnect VPN network to the Voice Servers network and also to allow bidirectional communication within the AnyConnect clients.

    • Navigate to the NAT configuration: Devices > NAT.
    • ensure that the NAT exemption rule is configured for the correct source (Voice Servers) and destination (AnyConnect VPN Pool) networks, and the hairpin NAT rule to allow AnyConnect client to AnyConnect client communication is in place. Moreover, check that the correct inbound and outbound interfaces configuration is in place for each rule, per your network design, as shown in the image.

Step 3. Verify that SIP inspection is disabled.

Please review the previous section AnyConnect clients cannot establish phone calls to know how to disable SIP inspection.

Step 4. Verify Access Control Policy.

Cisco Anyconnect Vpn Port Requirements

Per your Access Control Policy configuration, ensure that traffic from the AnyConnect clients is allowed to reach the Voice servers and involved networks, as shown in the image.

Related Information

  • This video provides the configuration example for the different issues discussed in this document.
  • For additional assistance, please contact Technical Assistance center (TAC). A valid support contract is required: Cisco Worldwide Support Contacts.
  • You can also visit the Cisco VPN Community here.

Access to most active sessions in Cisco dCloud requires a VPN connection between your laptop and the dCloud data center that is hosting your active session.

Use one of the three options below to connect your laptop to an active dCloud session using Cisco AnyConnect VPN Client:

All options are described below in order of recommended use.

Due to differences in operating systems and AnyConnect versions, your screens may differ slightly from those included in the steps below.

Use Cisco AnyConnect Client Already Installed on Your Laptop

If you are logged in to Cisco AnyConnect, please log off before starting this procedure.

To use the Cisco AnyConnect client already installed on your laptop:

  1. In dCloud, go to My Hub > Sessions, find the active session, and then click View.
  2. Click Details.
  3. In the Session Details window, scroll to the AnyConnect Credentials section.
  4. Start Cisco AnyConnect on your laptop.
  5. Copy the Host URL from the AnyConnect Credentials, paste it in the URL Connection box in the AnyConnect login window, and then click Connect.

If you get a connection error, remove the “https://” part of the URL and try the connection again.

Vpn
  1. Copy a user ID (Users) and the password from the AnyConnect Credentials and then paste each into the Cisco AnyConnect login window.
  2. Click OK.
  3. Click Accept on the window confirming your connection.
  4. When connected to your AnyConnect VPN session, the AnyConnect VPN icon is displayed in the system tray (Windows) or task bar (Mac).
  5. To view connection details or to disconnect, click the AnyConnect VPN icon and then choose Disconnect.

Download and Install Cisco AnyConnect Client from Cisco.com

If you encounter any issues with this method, please use the method described in the Use the dCloud Browser Based Cisco AnyConnect.

To download and install the Cisco AnyConnect client from Cisco.com:

  1. Go to the Cisco Support & Downloads page.
    1. You must be logged in with your Cisco.com credentials.
    2. You may be prompted to accept or comply with additional terms in order to download the software. Follow the directions in the popup window.
  2. In the Downloads box, enter anyconnect.
  3. In the search results, choose the version of AnyConnect you want to install.
    1. Cisco dCloud recommends installing the latest version of AnyConnect Secure Mobility Client.
  4. Locate the package you need based on your operating system.
    1. For Windows users, we recommend choosing Full installation package – Window / Standalone installer (ISO).
    2. For Mac users, we recommend choosing Full installation package – Mac OS X / Standalone installer (DMG).
  5. Click Download.
    1. You may be required to accept or comply with additional terms in order to download the software; follow the directions in the popup windows.
  6. Review the Cisco End User License Agreement and then click Accept LicenseAgreement.
  7. Install the AnyConnect software on your laptop.
  8. In dCloud, go to My Hub > Sessions, find the active session, and then click the View button.
  9. Click Details.
  10. In the Session Details window, scroll to the AnyConnect Credentials section.
    1. The AnyConnect Credentials in your active session are needed to download the software and log in.
  1. Start Cisco AnyConnect on your laptop.
  2. Copy the HostURL from the AnyConnect Credentials, paste it in the URL Connection box in the AnyConnect login window, and then click Connect.

If you get a connection error, remove the “https://” part of the URL and try the connection again.

  1. Copy a user ID (Users) and the Password from the AnyConnect Credentials, paste each into the Cisco AnyConnect login window, and then click OK.
  1. Click Accept on the window confirming your connection.
  2. When connected to your AnyConnect VPN session, the AnyConnect VPN icon is displayed in the system tray (Windows) or task bar (Mac).
  3. To view connection details or to disconnect, click the AnyConnect VPN icon and then choose Disconnect.

Use the dCloud Browser Based Cisco AnyConnect

Due to the Java applet used by this method, you may encounter compatibility issues with your local browser and/or installed version of Java. Use this option only if you cannot install the Cisco AnyConnect VPN Client on your laptop.

To use the dCloud browser based Cisco AnyConnect:

  1. In dCloud, go to My Hub > Sessions, find the active session, and then click the View button.
  2. Click Details.
  3. In the Session Details window, scroll to the AnyConnect Credentials section.
    1. Scroll down to view the AnyConnect Credentials for your active session, which are needed to download the software and log in.
  4. Click the question mark, and then find the section Use the dCloud Browser Based Cisco AnyConnect.
  5. Click the link next to Click the Host URL to start this option. You are brought to the AnyConnect server address for the dCloud data center hosting your session. For example, the AnyConnect server address for the Americas data center is https://dcloud-rtp-anyconnect.cisco.com.
    1. Accept any security alerts or certificate warnings.
      The SSL VPN Service window opens in a new browser tab (or new window).
  1. Copy a user ID (Users) and the passwordfrom the AnyConnect Credentials and then paste each into the SSL VPN Service Login window
  2. Click Login.

If the automatic installation does not start, close and re-open your browser window.

  1. Follow the on-screen instructions to connect to AnyConnect.
    1. Accept any security alerts or certification warnings.
  2. When you have successfully connected to AnyConnect:
    1. A window displays, similar to below, advising of a successful connection.
    2. The AnyConnect VPN icon is displayed in the system tray (Windows) or task bar (Mac).

If the automatic installation fails, install AnyConnect manually by following the on-screen instructions.

  1. To view connection details or to disconnect, click the AnyConnect VPN icon and then choose Disconnect.