ASAv в облаке AWS, трафик vpnUser заблокирован от VPN к локальному сайту

[BigWANTheory]

Я настроил ASAv в AWS
и сконфигурировал IKEv2 IPSEC VPN между ним и моим локальным Juniper SRX.
Я также настроил шлюз AnyConnect VPN, используя тот же внешний интерфейс, что и шлюз VPN. Аутентификация пользователей VPN должна проходить через туннель IPSEC, чтобы достичь сервера Radius.
Мой туннель IPSEC работает,
но когда я тестирую трафик от внутреннего интерфейса к серверу Radius, он отбрасывается ASAv.
У меня нет настроенного ACL, который бы блокировал этот трафик.
Вот полная конфигурация ASAv: ciscoasa# sh run
: Saved :
: Serial Number: xxxxxxxxxxxx
: Hardware: ASAv, 7680 MB RAM, CPU Xeon 4100/6100/8100 series 3000 MHz, 1 CPU (4 cores)
:
ASA Version 9.23(1)22
!
hostname ciscoasa
enable password ***** pbkdf2
service-module 0 keepalive-timeout 4
service-module 0 keepalive-counter 6
names
name 129.6.15.28 time-a.nist.gov
name 129.6.15.29 time-b.nist.gov
name 129.6.15.30 time-c.nist.gov
no mac-address auto
ip local pool SSL-RAVPN-Pool 10.251.14.160-10.251.14.190 mask 255.255.255.224 !
interface Management0/0 management-only nameif management security-level 100 ip address dhcp setroute
!
interface TenGigabitEthernet0/0 nameif INSIDE security-level 100 ip address 192.168.1.234 255.255.255.0
!
interface TenGigabitEthernet0/1 nameif OUTSIDE security-level 0 ip address 192.168.2.164 255.255.255.0
!
interface Tunnel1 nameif VPN-SCDC ip address 169.254.250.1 255.255.255.252 tunnel source interface OUTSIDE tunnel destination 123.123.45.66 tunnel mode ipsec ipv4 tunnel protection ipsec profile SCDC-VPN-PROFILE
!
tcpproxy tx-q-limit 2000
tcpproxy rtx-q-limit 2000
ftp mode passive
dns domain-lookup OUTSIDE
dns server-group DefaultDNS name-server 8.8.8.8 OUTSIDE
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
no object-group-search access-control
object network ASA_OUTSIDE_PRIVATE host 192.168.2.164
object network ASA_OUTSIDE_PUBLIC host 54.46.36.83
object network NET_INSIDE subnet 192.168.1.0 255.255.255.0
object network NET_SCDC subnet 172.25.0.0 255.255.0.0
access-group INSIDE-IN in interface INSIDE
access-group allow-all out interface INSIDE
access-group allow-all global
access-list allow-all extended permit ip any4 any4
access-list allow-all extended permit ip any6 any6
access-list OUTSIDE_IN extended permit icmp any any
access-list OUTSIDE_IN extended permit udp host 192.168.1.234 host 10.251.100.241 eq 1812
access-list OUTSIDE_IN extended permit udp host 192.168.1.234 host 10.251.100.242 eq 1812
access-list OUTSIDE_IN extended permit udp host 192.168.1.234 host 10.251.100.241 eq 1813
access-list OUTSIDE_IN extended permit udp host 192.168.1.234 host 10.251.100.242 eq 1813
access-list ICMP_MGMT extended permit icmp any any
access-list ACL-IKEV2 extended permit ip 192.168.1.0 255.255.255.0 172.25.0.0 255.255.0.0
access-list VPN-SCDC-IN extended permit ip any any
access-list newyork-filter extended permit udp any4 host 10.251.22.15 eq domain
access-list newyork-filter extended permit udp any4 host 10.251.22.18 eq domain
access-list newyork-filter extended deny ip any4 object-group GPSF-Internal
access-list newyork-filter extended permit ip any4 any4
access-list newyork-filter extended permit udp any4 host 172.25.116.27 eq domain
access-list newyork-filter extended permit udp any4 host 172.25.116.28 eq domain
access-list RSA-newyork extended permit ip any any
access-list INSIDE-IN extended permit udp 192.168.1.0 255.255.255.0 host 10.251.100.241 eq 1812
access-list INSIDE-IN extended permit udp 192.168.1.0 255.255.255.0 host 10.251.100.242 eq 1812
access-list INSIDE-IN extended permit udp 192.168.1.0 255.255.255.0 host 10.251.100.241 eq 1813
access-list INSIDE-IN extended permit udp 192.168.1.0 255.255.255.0 host 10.251.100.242 eq 1813
access-list INSIDE-IN extended permit ip any any
pager lines 23
mtu management 1500
mtu INSIDE 1500
mtu OUTSIDE 1500
no failover
no failover wait-disable
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
icmp permit any echo INSIDE
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
logging enable
logging asdm informational
nat (OUTSIDE,INSIDE) source dynamic any interface
nat (INSIDE,OUTSIDE) source static NET_INSIDE NET_INSIDE destination static NET_SCDC NET_SCDC no-proxy-arp route-lookup
!
object network ASA_OUTSIDE_PRIVATE nat (OUTSIDE,OUTSIDE) static ASA_OUTSIDE_PUBLIC
route OUTSIDE 0.0.0.0 0.0.0.0 192.168.2.1 1
route VPN-SCDC 10.251.100.241 255.255.255.255 169.254.250.2 1
route VPN-SCDC 10.251.100.242 255.255.255.255 169.254.250.2 1
route VPN-SCDC 172.25.0.0 255.255.0.0 169.254.250.2 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
aaa-server rsa-newyork protocol radius
aaa-server rsa-newyork (INSIDE) host 10.251.100.241 retry-interval 5 timeout 30 key ***** authentication-port 1812 accounting-port 1813
aaa-server rsa-newyork (INSIDE) host 10.251.100.242 retry-interval 5 timeout 30 key ***** authentication-port 1812 accounting-port 1813
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
aaa authentication match RSA-newyork OUTSIDE rsa-newyork
aaa accounting match RSA-newyork OUTSIDE rsa-newyork
aaa authentication login-history
http server enable
http 0.0.0.0 0.0.0.0 management
http 0.0.0.0 0.0.0.0 INSIDE
no snmp-server location
no snmp-server contact
crypto ipsec ikev2 ipsec-proposal SCDC-IKEv2-PROPOSAL protocol esp encryption aes-256 protocol esp integrity sha-256
crypto ipsec profile SCDC-VPN-PROFILE set ikev2 ipsec-proposal SCDC-IKEv2-PROPOSAL set pfs group14 set security-association lifetime seconds 3600
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint _SmartCallHome_ServerCA no validation-usage crl configure
crypto ca trustpoint _SmartCallHome_ServerCA2 no validation-usage crl configure
crypto ca trustpoint ASDM_TrustPoint0 enrollment terminal crl configure
crypto ca trustpoint ASDM_TrustPoint1 keypair ASDM_TrustPoint1 crl configure
crypto ca trustpoint ASDM_TrustPoint1-1 crl configure
crypto ca trustpool policy auto-import
crypto ca certificate chain _SmartCallHome_ServerCA crypto ikev2 policy 10 encryption aes-256 integrity sha256 group 14 prf sha256 lifetime seconds 28800
crypto ikev2 enable OUTSIDE
telnet timeout 10
ssh scopy enable
ssh stricthostkeycheck
ssh timeout 60
ssh key-exchange group dh-group14-sha256
ssh 0.0.0.0 0.0.0.0 management
ssh ::/0 management
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server time-c.nist.gov
ntp server time-b.nist.gov
ntp server time-a.nist.gov
ssl trust-point ASDM_TrustPoint1 OUTSIDE
webvpn enable OUTSIDE http-headers hsts-server enable max-age 31536000 include-sub-domains no preload hsts-client enable x-content-type-options x-xss-protection content-security-policy anyconnect profiles PermitRDP disk0:/PermitRDP.xml anyconnect enable cache disable error-recovery disable
group-policy RSA-newyork internal
group-policy RSA-newyork attributes dns-server value 10.251.22.15 10.251.22.18 vpn-simultaneous-logins 1 vpn-idle-timeout 60 vpn-session-timeout 720 vpn-tunnel-protocol ssl-client split-tunnel-policy tunnelall webvpn anyconnect mtu 1300 anyconnect ask none default anyconnect
dynamic-access-policy-record DfltAccessPolicy
username admin_asdm password ***** pbkdf2 privilege 15
username admin password ***** pbkdf2 privilege 15
username admin attributes service-type admin ssh authentication publickey bb:55:51:3d:36:bc:b1:e1:d6:ed:27:c8:ac:57:e3:50:cb:57:29:63:0e:f2:15:f6:0e:c3:dc:cb:edb0:48 hashed
username netadmin password ***** pbkdf2 privilege 15
username netadmin attributes service-type admin
tunnel-group RSA-newyork type remote-access
tunnel-group RSA-newyork general-attributes authentication-server-group rsa-newyork default-group-policy RSA-newyork
tunnel-group RSA-newyork webvpn-attributes group-alias RSA-newyork enable group-url https://svpn-sh.arcgames.com/rsa-newyork enable
tunnel-group 123.123.45.66 type ipsec-l2l
tunnel-group 123.123.45.66 ipsec-attributes peer-id-validate nocheck ikev2 remote-authentication pre-shared-key ***** ikev2 local-authentication pre-shared-key *****
!
class-map inspection_default match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1 parameters message-length maximum client auto message-length maximum 512 no tcp-inspection
policy-map global_policy class inspection_default inspect dns migrated_dns_map_1 inspect ftp inspect h323 h225 inspect h323 ras inspect ip-options inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect icmp
policy-map type inspect dns migrated_dns_map_2 parameters message-length maximum client auto message-length maximum 512 no tcp-inspection
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home profile License destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination transport-method http profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address email callhome@cisco.com destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:78d801f541af0d2e8db87ffe51eadf35
: end Вот вывод packet-tracer: ciscoasa# packet-tracer input insiDE tcp 192.168.1.234 12345 10.251.100.242 1812 det Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Elapsed time: 5456 ns
Config:
Implicit Rule
Additional Information: Forward Flow based lookup yields rule: in id=0x7febe1a7d8c0, priority=1, domain=permit, deny=false hits=6, user_data=0x0000000000000000, cs_id=0x0, l3_type=0x8 src mac=0000.0000.0000, mask=0000.0000.0000 dst mac=0000.0000.0000, mask=0100.0000.0000 input_ifc=INSIDE, output_ifc=any Phase: 2
Type: INPUT-ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Elapsed time: 11253 ns
Config:
Additional Information:
Found next-hop 169.254.250.2 using egress ifc VPN-SCDC Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Elapsed time: 5342 ns
Config:
Implicit Rule
Additional Information: Forward Flow based lookup yields rule: in id=0x7febe1a900e0, priority=501, domain=permit, deny=true hits=6, user_data=0x0000000000000007, cs_id=0x0, reverse, flags=0x0, protocol=0 src ip/id=192.168.1.234, mask=255.255.255.255, port=0, tag=any dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dscp=0x0, input_ifc=INSIDE, output_ifc=any Result:
input-interface: INSIDE
input-status: up
input-line-status: up
output-interface: VPN-SCDC
output-status: up
output-line-status: up
Action: drop
Time Taken: 22051 ns
Drop-reason: (acl-drop) Flow is denied by configured rule, Drop-location: frame snp_classify_table_lookup:6051 flow (NA)/NA Кто-нибудь знает, почему это происходит?

[Cristian Matei]

Здравствуйте, В ASA существует архитектурное ограничение, означающее, что трафик, исходящий из устройства или направляющийся в устройство, не может проходить через него: например, если вы хотите выполнить ping хосту, доступному с точки зрения маршрутизации на внешнем интерфейсе ASA, вы не можете использовать никакой другой интерфейс источника, кроме внешнего интерфейса, поскольку использование внутреннего интерфейса означает, что трафик будет проходить через устройство, изнутри наружу, что не допускается. Это ограничение существовало с самого начала ASA/PIX, оно по-прежнему существует по соображениям безопасности и не может быть отключено. Судя по вашей конфигурации, вы подпадаете под это ограничение, поскольку ваш сервер RADIUS настроен с интерфейсом INSIDE (который будет работать только в том случае, если сервер RADIUS доступен с точки зрения маршрутизации через интерфейс INSIDE), однако вывод вашего пакетного трассировщика показывает, что сервер RADIUS доступен с точки зрения маршрутизации через интерфейс VPN-туннеля. Решение заключается в том, чтобы настроить интерфейс Loopback, назначить ему подсеть IPv4 /32, дать ему имя, например LOOPBACK, убедиться, что эта подсеть /32 маршрутизируется через VPN-туннель в обоих направлениях, и перенастроить ваш сервер RADIUS на использование Loopback nameif вместо INSIDE. Спасибо, Кристиан.

[Rob Ingram]

@BigWANTheory
используйте интерфейс обратной связи в качестве исходного интерфейса для AAA и убедитесь, что удаленная сторона имеет маршрут к этому интерфейсу обратной связи.

[BigWANTheory]

Спасибо, это значит
, что мне также нужно будет настроить интерфейс обратной связи на стороне AWS?

[Rob Ingram]

@BigWANTheory
вы настраиваете обратную связь на ASAv

[BigWANTheory]

@Роб Ингрэм
написал:
@BigWANTheory
вы настраиваете обратную связь на ASAv ciscoasa# ping 192.168.5.100
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.5.100, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
ciscoasa# packet-tracer input insiDE tcp 192.168.5.100 12345 10.251.100.242 18$ Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Elapsed time: 7843 ns
Config:
Implicit Rule
Additional Information: Forward Flow based lookup yields rule: in id=0x7febe1a7d8c0, priority=1, domain=permit, deny=false hits=7, user_data=0x0000000000000000, cs_id=0x0, l3_type=0x8 src mac=0000.0000.0000, mask=0000.0000.0000 dst mac=0000.0000.0000, mask=0100.0000.0000 input_ifc=INSIDE, output_ifc=any Phase: 2
Type: INPUT-ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Elapsed time: 13299 ns
Config:
Additional Information:
Found next-hop 169.254.250.2 using egress ifc VPN-SCDC Phase: 3
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Elapsed time: 4887 ns
Config:
access-group INSIDE-IN in interface INSIDE
access-list INSIDE-IN extended permit ip any any
Additional Information: Forward Flow based lookup yields rule: in id=0x7febec028ad0, priority=13, domain=permit, deny=false hits=0, user_data=0x0000000000000000, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, input_ifc=INSIDE, output_ifc=any Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Elapsed time: 4887 ns
Config:
Additional Information: Forward Flow based lookup yields rule: in id=0x7febe15df930, priority=0, domain=nat-per-session, deny=false hits=1291604, user_data=0x0000000000000000, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, input_ifc=any, output_ifc=any Phase: 5
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Elapsed time: 4887 ns
Config:
Additional Information: Forward Flow based lookup yields rule: in id=0x7febe1a87970, priority=0, domain=inspect-ip-options, deny=true hits=0, user_data=0x0000000000000000, cs_id=0x0, reverse, flags=0x0, protocol=0 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dscp=0x0, input_ifc=INSIDE, output_ifc=any Phase: 6
Type: QOS
Subtype:
Result: ALLOW
Elapsed time: 26939 ns
Config:
Additional Information: Forward Flow based lookup yields rule: in id=0x7febe4017600, priority=70, domain=qos-per-class, deny=false hits=43849, user_data=0x00007febe4017290, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=0 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, input_ifc=any, output_ifc=any Phase: 7
Type: VPN
Subtype: encrypt
Result: ALLOW
Elapsed time: 3751 ns
Config:
Additional Information: Forward Flow based lookup yields rule: out id=0x7febe4124030, priority=70, domain=encrypt, deny=false hits=1, user_data=0x000000000000155c, cs_id=0x0, reverse, flags=0x0, protocol=0 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dscp=0x0, input_ifc=any, output_ifc=VPN-SCDC Phase: 8
Type: QOS
Subtype:
Result: ALLOW
Elapsed time: 19096 ns
Config:
Additional Information: Reverse Flow based lookup yields rule: in id=0x7febe4017600, priority=70, domain=qos-per-class, deny=false hits=43850, user_data=0x00007febe4017290, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=0 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, input_ifc=any, output_ifc=any Phase: 9
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Elapsed time: 341 ns
Config:
Additional Information: Reverse Flow based lookup yields rule: in id=0x7febe428e710, priority=69, domain=ipsec-tunnel-flow, deny=false hits=1, user_data=0x000000000000275c, cs_id=0x0, reverse, flags=0x0, protocol=0 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dscp=0x0, input_ifc=VPN-SCDC, output_ifc=any Phase: 10
Type: NAT
Subtype: per-session
Result: ALLOW
Elapsed time: 1023 ns
Config:
Additional Information: Reverse Flow based lookup yields rule: in id=0x7febe15df930, priority=0, domain=nat-per-session, deny=false hits=1291606, user_data=0x0000000000000000, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, input_ifc=any, output_ifc=any Phase: 11
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Elapsed time: 341 ns
Config:
Additional Information: Reverse Flow based lookup yields rule: in id=0x7febe1b4a6a0, priority=0, domain=inspect-ip-options, deny=true hits=1, user_data=0x0000000000000000, cs_id=0x0, reverse, flags=0x0, protocol=0 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dscp=0x0, input_ifc=VPN-SCDC, output_ifc=any Phase: 12
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Elapsed time: 19096 ns
Config:
Additional Information:
New flow created with id 1273875, packet dispatched to next module
Module information for forward flow ...
snp_fp_inspect_ip_options
snp_fp_tcp_normalizer
snp_fp_tls_watcher
snp_fp_translate
snp_fp_adjacency
snp_fp_encrypt
snp_fp_fragment
snp_fp_tracer_drop
snp_ifc_stat Module information for reverse flow ...
snp_fp_inspect_ip_options
snp_fp_ipsec_tunnel_flow
snp_fp_translate
snp_fp_tcp_normalizer
snp_fp_tls_watcher
snp_fp_adjacency
snp_fp_fragment
snp_fp_tracer_drop
snp_ifc_stat Result:
input-interface: INSIDE
input-status: up
input-line-status: up
output-interface: VPN-SCDC
output-status: up
output-line-status: up
Action: allow
Time Taken: 106390 ns

[Cristian Matei]

Привет, @BigWANTheory
Только со стороны ASAv. Спасибо, Кристиан.