Solved

Cisco ASA 5510 Hairpinning

Posted on 2007-12-02
4
3,615 Views
Last Modified: 2008-02-01
We have an ASA 5510 in which both hardware IPsec and Client IPsec connections terminate.

I have trying to setup same interface security and hairpinning to allow VPN clients connectivity to the local LAN, remote VPN sites, and Internet access while connected.

The current configuration I have already allows everything except Internet access while connected to the VPN Client. I used the same-security intra-interface configuration.

What am I missing to allow Internet access to VPN clients connected?

Thanks in advance
AB
0
Comment
Question by:AmericanBridge
  • 2
  • 2
4 Comments
 
LVL 16

Expert Comment

by:2PiFL
ID: 20393099
You need to create a static route from the vpn interface to the outside interface.
0
 
LVL 1

Author Comment

by:AmericanBridge
ID: 20393316
The outside Interface is a directly connected interface, it already knows about the outside network.
0
 
LVL 1

Author Comment

by:AmericanBridge
ID: 20393531
I figured it out.

You have to perform  5 tasks.

1. configure the VPN client group, IP pool, isakmp policy etc.
2. configure an outside nat statement for the vpn group ip pool of the clients
3. configure access-list nonat statements for the vpn client group
4. apply the nonat access-list to the outside interface nat statement
5 configure the port for same-security-traffic permit intra-interface.
6. Apply the command, split-tunnel-policy tunnelall

And there you have it. All VPN clients can connect, create ipsec traffic to other VPN tunnels and can connect to the internet on the ASA configured NAT (PAT) IP address on the outside interface.

0
 
LVL 16

Accepted Solution

by:
2PiFL earned 500 total points
ID: 20395150
Correction:

you need 3 things: (the numbers are for reference only)

access-list InsideACL extended permit tcp any 192.168.3.0 255.255.255.0

nat (outside) 1 192.168.3.0 255.255.255.0

access-group InsideACL in interface inside



0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you use NetMotion Mobility on your PC and plan to upgrade to Windows 10, it may not work unless you take these steps.
Let’s list some of the technologies that enable smooth teleworking. 
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

820 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question