AmericanBridge
asked on
Cisco ASA 5510 Hairpinning
We have an ASA 5510 in which both hardware IPsec and Client IPsec connections terminate.
I have trying to setup same interface security and hairpinning to allow VPN clients connectivity to the local LAN, remote VPN sites, and Internet access while connected.
The current configuration I have already allows everything except Internet access while connected to the VPN Client. I used the same-security intra-interface configuration.
What am I missing to allow Internet access to VPN clients connected?
Thanks in advance
AB
I have trying to setup same interface security and hairpinning to allow VPN clients connectivity to the local LAN, remote VPN sites, and Internet access while connected.
The current configuration I have already allows everything except Internet access while connected to the VPN Client. I used the same-security intra-interface configuration.
What am I missing to allow Internet access to VPN clients connected?
Thanks in advance
AB
You need to create a static route from the vpn interface to the outside interface.
ASKER
The outside Interface is a directly connected interface, it already knows about the outside network.
ASKER
I figured it out.
You have to perform 5 tasks.
1. configure the VPN client group, IP pool, isakmp policy etc.
2. configure an outside nat statement for the vpn group ip pool of the clients
3. configure access-list nonat statements for the vpn client group
4. apply the nonat access-list to the outside interface nat statement
5 configure the port for same-security-traffic permit intra-interface.
6. Apply the command, split-tunnel-policy tunnelall
And there you have it. All VPN clients can connect, create ipsec traffic to other VPN tunnels and can connect to the internet on the ASA configured NAT (PAT) IP address on the outside interface.
You have to perform 5 tasks.
1. configure the VPN client group, IP pool, isakmp policy etc.
2. configure an outside nat statement for the vpn group ip pool of the clients
3. configure access-list nonat statements for the vpn client group
4. apply the nonat access-list to the outside interface nat statement
5 configure the port for same-security-traffic permit intra-interface.
6. Apply the command, split-tunnel-policy tunnelall
And there you have it. All VPN clients can connect, create ipsec traffic to other VPN tunnels and can connect to the internet on the ASA configured NAT (PAT) IP address on the outside interface.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.