?
Solved

Cisco ASA 5510 Hairpinning

Posted on 2007-12-02
4
Medium Priority
?
3,621 Views
Last Modified: 2008-02-01
We have an ASA 5510 in which both hardware IPsec and Client IPsec connections terminate.

I have trying to setup same interface security and hairpinning to allow VPN clients connectivity to the local LAN, remote VPN sites, and Internet access while connected.

The current configuration I have already allows everything except Internet access while connected to the VPN Client. I used the same-security intra-interface configuration.

What am I missing to allow Internet access to VPN clients connected?

Thanks in advance
AB
0
Comment
Question by:AmericanBridge
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 16

Expert Comment

by:2PiFL
ID: 20393099
You need to create a static route from the vpn interface to the outside interface.
0
 
LVL 1

Author Comment

by:AmericanBridge
ID: 20393316
The outside Interface is a directly connected interface, it already knows about the outside network.
0
 
LVL 1

Author Comment

by:AmericanBridge
ID: 20393531
I figured it out.

You have to perform  5 tasks.

1. configure the VPN client group, IP pool, isakmp policy etc.
2. configure an outside nat statement for the vpn group ip pool of the clients
3. configure access-list nonat statements for the vpn client group
4. apply the nonat access-list to the outside interface nat statement
5 configure the port for same-security-traffic permit intra-interface.
6. Apply the command, split-tunnel-policy tunnelall

And there you have it. All VPN clients can connect, create ipsec traffic to other VPN tunnels and can connect to the internet on the ASA configured NAT (PAT) IP address on the outside interface.

0
 
LVL 16

Accepted Solution

by:
2PiFL earned 1000 total points
ID: 20395150
Correction:

you need 3 things: (the numbers are for reference only)

access-list InsideACL extended permit tcp any 192.168.3.0 255.255.255.0

nat (outside) 1 192.168.3.0 255.255.255.0

access-group InsideACL in interface inside



0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
Use of TCL script on Cisco devices:  - create file and merge it with running configuration to apply configuration changes
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

800 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question