• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 3661
  • Last Modified:

Cisco ASA 5510 Hairpinning

We have an ASA 5510 in which both hardware IPsec and Client IPsec connections terminate.

I have trying to setup same interface security and hairpinning to allow VPN clients connectivity to the local LAN, remote VPN sites, and Internet access while connected.

The current configuration I have already allows everything except Internet access while connected to the VPN Client. I used the same-security intra-interface configuration.

What am I missing to allow Internet access to VPN clients connected?

Thanks in advance
AB
0
AmericanBridge
Asked:
AmericanBridge
  • 2
  • 2
1 Solution
 
2PiFLCommented:
You need to create a static route from the vpn interface to the outside interface.
0
 
AmericanBridgeAuthor Commented:
The outside Interface is a directly connected interface, it already knows about the outside network.
0
 
AmericanBridgeAuthor Commented:
I figured it out.

You have to perform  5 tasks.

1. configure the VPN client group, IP pool, isakmp policy etc.
2. configure an outside nat statement for the vpn group ip pool of the clients
3. configure access-list nonat statements for the vpn client group
4. apply the nonat access-list to the outside interface nat statement
5 configure the port for same-security-traffic permit intra-interface.
6. Apply the command, split-tunnel-policy tunnelall

And there you have it. All VPN clients can connect, create ipsec traffic to other VPN tunnels and can connect to the internet on the ASA configured NAT (PAT) IP address on the outside interface.

0
 
2PiFLCommented:
Correction:

you need 3 things: (the numbers are for reference only)

access-list InsideACL extended permit tcp any 192.168.3.0 255.255.255.0

nat (outside) 1 192.168.3.0 255.255.255.0

access-group InsideACL in interface inside



0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

How do you know if your security is working?

Protecting your business doesn’t have to mean sifting through endless alerts and notifications. With WatchGuard Total Security Suite, you can feel confident that your business is secure, meaning you can get back to the things that have been sitting on your to-do list.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now