Question

Cisco VPN client with split-tunneling is not working

Asked by: jgrammer42

I am having a problem getting split-tunneling to work using the Cisco VPN client v5.0 attaching to a Cisco 5540 ASA.

The client works fine without split-tunneling active.  I can VPN in and get to all of my internal LAN systems.  BUT, (as you are aware), you cannot browse the Inet from the client PC when using the Cisco client.  To work around this, I need to activate split-tunneling.

When I setup an access-list for split tunneling and add the commands for the group-policy, I can VPN in, BUT, I cannot get to any internal systems, but I CAN browse the Internet.

The code attached is the un-changed code that works with the Cisco VPN client but without Internet browsing and no split-tunnel active.

When I add the commands of
access-list SPLIT-TUNNEL standard permit 192.168.150.0 255.255.255.0

split-tunnel-policy tunnelspecified
split-tunnel-network-list value SPLIT-TUNNEL

That is when the Cisco VPN client allows me to browse the Ineternet, but does NOT let me access any internal network systems.

What am I missing?

Thanks in advance for all the help,

Jeff

:
ASA Version 7.2(3) 
!
hostname COM-P10-ASA
domain-name domain.com
names
!
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 70.5.150.35 255.255.255.224 
!
interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 172.20.1.7 255.255.0.0 
!
interface GigabitEthernet0/2
 nameif dmz
 security-level 0
 ip address 192.168.175.3 255.255.255.0 
!
interface GigabitEthernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 nameif ASA-Mgmt
 security-level 0
 ip address 192.168.10.1 255.255.255.0 
!
 
ftp mode passive
dns server-group DefaultDNS
 domain-name domain.com
access-list OUTSIDE extended permit icmp any any 
access-list OUTSIDE extended permit tcp any host 70.5.150.40 eq www 
access-list OUTSIDE extended permit tcp any host 70.5.150.41 eq www 
access-list OUTSIDE extended permit tcp any host 70.5.150.41 eq https 
access-list OUTSIDE extended permit tcp any host 70.5.150.41 eq pop3 
access-list OUTSIDE extended permit tcp any host 70.5.150.41 eq imap4 
access-list OUTSIDE extended permit tcp host 201.27.136.180 host 70.5.150.43 eq smtp 
access-list VPN extended permit ip 172.20.0.0 255.255.0.0 192.168.200.0 255.255.255.0 
access-list VPN extended permit ip 192.168.175.0 255.255.255.0 192.168.200.0 255.255.255.0 
access-list VPN extended permit ip 172.20.0.0 255.255.0.0 172.21.0.0 255.255.0.0 
access-list VPN extended permit ip 172.20.0.0 255.255.0.0 172.22.0.0 255.255.0.0 
access-list VPN extended permit ip 172.20.0.0 255.255.0.0 192.168.150.0 255.255.255.0 
access-list DMZ extended permit icmp any any 
access-list DMZ extended permit udp any any 
access-list DMZ extended permit tcp any any 
access-list DMZ extended permit ip 192.168.175.0 255.255.255.0 192.168.200.0 255.255.255.0 
access-list JDG extended permit ip 172.20.0.0 255.255.0.0 192.168.200.0 255.255.255.0
access-list COM-GA extended permit ip 172.20.0.0 255.255.0.0 172.21.0.0 255.255.0.0 
access-list COM-MD extended permit ip 172.20.0.0 255.255.0.0 172.22.0.0 255.255.0.0 
pager lines 24
mtu outside 1500
mtu inside 1500
mtu dmz 1500
mtu ASA-Mgmt 1500
ip local pool etpool 192.168.150.1-192.168.150.254
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/pdm
no asdm history enable
arp timeout 14400
global (outside) 1 interface
global (dmz) 1 192.168.175.253
nat (inside) 0 access-list VPN
nat (inside) 1 0.0.0.0 0.0.0.0
access-group OUTSIDE in interface outside
access-group DMZ in interface dmz
route outside 0.0.0.0 0.0.0.0 70.5.150.62 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa-server RADIUS protocol radius
aaa-server RADIUS host 172.20.3.3
key key-for-radius-connection
http server enable
http 172.20.0.0 255.255.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set etiset esp-des esp-md5-hmac 
crypto ipsec transform-set etiset2 esp-3des esp-md5-hmac 
crypto ipsec transform-set etiset3 esp-3des esp-sha-hmac 
crypto ipsec security-association lifetime seconds 3600
crypto dynamic-map etivpn 10 set pfs group1
crypto dynamic-map etivpn 10 set transform-set etiset3
crypto map etimap 10 match address COM-GA
crypto map etimap 10 set peer 218.48.1.42 
crypto map etimap 10 set transform-set etiset2
crypto map etimap 20 match address COM-MD
crypto map etimap 20 set peer 92.46.54.106 
crypto map etimap 20 set transform-set etiset2
crypto map etimap 40 match address JDG
crypto map etimap 40 set peer 69.35.176.146 
crypto map etimap 40 set transform-set etiset2
crypto map etimap 40 set security-association lifetime seconds 28800
crypto map etimap 65000 ipsec-isakmp dynamic etivpn
crypto map etimap interface outside
crypto isakmp identity address 
crypto isakmp enable outside
crypto isakmp policy 20
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 3600
crypto isakmp policy 30
 authentication pre-share
 encryption des
 hash md5
 group 1
 lifetime 86400
crypto isakmp policy 50
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp nat-traversal  20
telnet 172.20.0.0 255.255.0.0 inside
telnet timeout 15
ssh 172.20.0.0 255.255.0.0 inside
ssh timeout 15
console timeout 0
!
class-map class_sip_tcp
 match port tcp eq sip
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect http 
  inspect ils 
  inspect pptp 
  inspect rsh 
  inspect rtsp 
  inspect skinny 
  inspect esmtp 
  inspect sqlnet 
  inspect tftp 
 class class_sip_tcp
  inspect sip 
!
service-policy global_policy global
group-policy COMVPN internal
group-policy COMVPN attributes
 wins-server value 172.20.3.11
 dns-server value 172.20.3.11
 vpn-tunnel-protocol IPSec 
 default-domain value int.domain.com
tunnel-group COMVPN type ipsec-ra
tunnel-group COMVPN general-attributes
 address-pool etpool
 authentication-server-group RADIUS
 default-group-policy COMVPN
tunnel-group COMVPN ipsec-attributes
 pre-shared-key *
tunnel-group COMVPN ppp-attributes
 authentication pap
 authentication ms-chap-v2
tunnel-group 69.35.176.146 type ipsec-l2l
tunnel-group 69.35.176.146 ipsec-attributes
 pre-shared-key *
tunnel-group 218.48.1.42 type ipsec-l2l
tunnel-group 218.48.1.42 ipsec-attributes
 pre-shared-key *
tunnel-group 92.46.54.106 type ipsec-l2l
tunnel-group 92.46.54.106 ipsec-attributes
 pre-shared-key *
prompt hostname context 
Cryptochecksum:b8010b5e5892c5a4dfe17c57ff70940a
: end
 
 COM-P10-ASA#
                                  
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189:
190:

Select allOpen in new window

This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

  • Plus...
  • 30 Day FREE access, no risk, no obligation
  • Collaborate with the world's top tech experts
  • Unlimited access to our exclusive solution database
  • Never be left without tech help again

Subscribe Now

Asked On
2009-09-16 at 10:32:36ID24737139
Tags

cisco

,

vpn

,

client

,

split-tunnel

,

split-tunneling

Topics

Cisco PIX Firewall

,

Virtual Private Networking (VPN)

Participating Experts
2
Points
500
Comments
7

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

  • "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
  • "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
  • "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Screenshot of Experts Exchange Knowledgebase

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Screenshot of an Article

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Screenshot of Experts Exchange Knowledgebase

Access the answers to your technology questions today.

Subscribe Now

30-day free trial. Register in 60 seconds.

What Makes Experts Exchange Unique?

Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Trusted by the world's most respected brands.

image of each brand's logo

Faithfully serving IT professionals since 1996.

Experts Exchange Logo

Try it out and discover for yourself.

Subscribe Now

30-day free trial. Register in 60 seconds.

Related Solutions

  1. VPN Tunnel ASA
    I have set up serveral VPN tunnels in the past but I can't seem to get this one working. It is between a ASA 5520 on my end and a ASA 5510 on the other end. Every thing looks right. I had the other engineer check some things on his end and they also seem right. The weird thin...
  2. Teardown CISCO VPN Tunnel
    Can someone tell me an effective way to tear down a CISCO VPN tunnel in my ASA?
  3. QOS on Cisco ASA 5505 VPN Tunnel
    I have two Cisco ASA 5505's, they are setup on a VPN across a 15/3meg connection each. I would like to setup for almost all service to be set for the VPN tunnel. We used to have a deticated 1meg connection and they are running about the same. Thanks.
  4. VPN Tunnel Between Cisco ASA and Netscreen
    Hi We are trying to build tunnel between Cisco ASA and Netscreen ...Tunnel is up but Not able to communicate other end servers. Debug has been attached as file . is some one can help whats wrong with this tunnel.
  5. Cisco ASA 5505 multi-vpn-tunnel
    I have two VPN sites. using CISCO. I have to VPN to one, drop, then connect to the other and then preform the opposite of that action to go back ot the other site. How can i configure a mutli-tunnel so i can have one single log on and have VPN access to both sites at once. I...
  6. Cisco ASA 5505 VPN Tunnels
    I have 4 remote sites that are connected to a central site via VPN tunnels. I installed one Cisco ASA 5505 at a remote site to improve reliability. The central site was also using a Linksys until yesterday. Adding these Cisco devices was done due to complaints about unreli...

Free Tech Articles

  1. WARNING: 5 Reasons why you should NEVER fix a computer for free.
    It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
  2. SCCM OSD Basic troubleshooting
    SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
  3. Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
    This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
  4. Create a Win7 Gadget
    This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
  5. Outlook continually prompting for username and password
    There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
  6. Backup Exchange 2010 Information Store using Windows Backup
    There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...

Cloud Class Webinars

  1. Avoiding Bugs in Microsoft Access
    Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
  2. Top 10 Best New Features in Visio 2010
    Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
  3. IT Consultant Business Secrets Revealed
    Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
  4. Disaster Recovery and Business Continuity
    Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
  5. Organize Your Visio Diagrams with Containers and Lists
    Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
  6. How to Us Objects, Properties, Events and Methods in Microsoft Access
    Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Join the Community

Answers

 

by: JFrederick29Posted on 2009-09-16 at 10:36:52ID: 25348021

The Split Tunnel policy shouldn't include the VPN pool but rather the subnets you need access to on the corporate network.

Should be:

access-list SPLIT-TUNNEL standard permit 172.20.0.0 255.255.0.0

split-tunnel-policy tunnelspecified
split-tunnel-network-list value SPLIT-TUNNEL

 

by: bmeyer1908Posted on 2009-09-16 at 10:41:02ID: 25348059

Try this.
This acl
access-list split_tunnel standard permit 172.20 255.255.0.0

Under group-policy COMVPN attributes put the following

split-tunnel-policy tunnelspecified
 split-tunnel-network-list value split_tunnel

 

by: jgrammer42Posted on 2009-09-16 at 10:41:34ID: 25348065

well....now I feel stupid!....

Thank you very much JFrederick29...

I will try that and see how it goes...

 

by: JFrederick29Posted on 2009-09-16 at 10:44:45ID: 25348102

Hi jgrammer42,

Did you accept the wrong solution?  If so, I can open this question back up and you can select my answer.

 

by: jgrammer42Posted on 2009-09-16 at 10:47:25ID: 25348130

JFrederick29,

Yes, I did accept the wrong one.

Please open it back up, so that I may correctly assign the points to you.

Thank you,

 

by: JFrederick29Posted on 2009-09-16 at 10:50:10ID: 25348155

Opened back up.  Thanks!  Much appreciated.

 

by: jgrammer42Posted on 2009-09-16 at 10:51:00ID: 31629568

An incredibly fast, (and correct), answer to the issue.

20120131-EE-VQP-002

3 Ways to Join

30-Day Free Trial

The Experts

98% positive feedback on 31,087 answers since March 2000. angeliii is a Microsoft Most Valuable Professional for his work with MS SQL Server & Develoment.

He has also proven his knowledge of Visual Basic Programming, PHP Scripting and Oracle Databases.

The Experts

97% positive feedback on 10,752 answers since July 2000. lrmoore has more than 18 years experience in the networking industry.

The six-time Mircosoft MVPs specialties include firewalls, virtual private networking, and network management.

Testimonials

"...and excellent source for support... Kind of like having your very own IT dept." Electriciansnet

Testimonials

"I was apprehensive at signing up at first. However... it has already made my life as an IT administrator much easier." JaCrews

Testimonials

"WOW! You guys have great, active, and knowledgeable people on here." moore50

Business Clients

Business Clients

In the Press

"If you’ve got a question... Experts Exchange can supply an answer.”

In the Press

"...an invaluable aid for both IT professionals and those who require tech support."

In the Press

"where IT professionals provide quick answers on just about any topic"

Business Account Plans

Loading Advertisement...