Solved

Cisco ASA 5510 Hairpinning

Posted on 2007-12-02
4
3,613 Views
Last Modified: 2008-02-01
We have an ASA 5510 in which both hardware IPsec and Client IPsec connections terminate.

I have trying to setup same interface security and hairpinning to allow VPN clients connectivity to the local LAN, remote VPN sites, and Internet access while connected.

The current configuration I have already allows everything except Internet access while connected to the VPN Client. I used the same-security intra-interface configuration.

What am I missing to allow Internet access to VPN clients connected?

Thanks in advance
AB
0
Comment
Question by:AmericanBridge
  • 2
  • 2
4 Comments
 
LVL 16

Expert Comment

by:2PiFL
ID: 20393099
You need to create a static route from the vpn interface to the outside interface.
0
 
LVL 1

Author Comment

by:AmericanBridge
ID: 20393316
The outside Interface is a directly connected interface, it already knows about the outside network.
0
 
LVL 1

Author Comment

by:AmericanBridge
ID: 20393531
I figured it out.

You have to perform  5 tasks.

1. configure the VPN client group, IP pool, isakmp policy etc.
2. configure an outside nat statement for the vpn group ip pool of the clients
3. configure access-list nonat statements for the vpn client group
4. apply the nonat access-list to the outside interface nat statement
5 configure the port for same-security-traffic permit intra-interface.
6. Apply the command, split-tunnel-policy tunnelall

And there you have it. All VPN clients can connect, create ipsec traffic to other VPN tunnels and can connect to the internet on the ASA configured NAT (PAT) IP address on the outside interface.

0
 
LVL 16

Accepted Solution

by:
2PiFL earned 500 total points
ID: 20395150
Correction:

you need 3 things: (the numbers are for reference only)

access-list InsideACL extended permit tcp any 192.168.3.0 255.255.255.0

nat (outside) 1 192.168.3.0 255.255.255.0

access-group InsideACL in interface inside



0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
Envision that you are chipping away at another e-business site with a team of pundit developers and designers. Everything seems, by all accounts, to be going easily.
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question