[Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Cisco ASA 5510 Hairpinning

Posted on 2007-12-02
4
Medium Priority
?
3,626 Views
Last Modified: 2008-02-01
We have an ASA 5510 in which both hardware IPsec and Client IPsec connections terminate.

I have trying to setup same interface security and hairpinning to allow VPN clients connectivity to the local LAN, remote VPN sites, and Internet access while connected.

The current configuration I have already allows everything except Internet access while connected to the VPN Client. I used the same-security intra-interface configuration.

What am I missing to allow Internet access to VPN clients connected?

Thanks in advance
AB
0
Comment
Question by:AmericanBridge
  • 2
  • 2
4 Comments
 
LVL 16

Expert Comment

by:2PiFL
ID: 20393099
You need to create a static route from the vpn interface to the outside interface.
0
 
LVL 1

Author Comment

by:AmericanBridge
ID: 20393316
The outside Interface is a directly connected interface, it already knows about the outside network.
0
 
LVL 1

Author Comment

by:AmericanBridge
ID: 20393531
I figured it out.

You have to perform  5 tasks.

1. configure the VPN client group, IP pool, isakmp policy etc.
2. configure an outside nat statement for the vpn group ip pool of the clients
3. configure access-list nonat statements for the vpn client group
4. apply the nonat access-list to the outside interface nat statement
5 configure the port for same-security-traffic permit intra-interface.
6. Apply the command, split-tunnel-policy tunnelall

And there you have it. All VPN clients can connect, create ipsec traffic to other VPN tunnels and can connect to the internet on the ASA configured NAT (PAT) IP address on the outside interface.

0
 
LVL 16

Accepted Solution

by:
2PiFL earned 1000 total points
ID: 20395150
Correction:

you need 3 things: (the numbers are for reference only)

access-list InsideACL extended permit tcp any 192.168.3.0 255.255.255.0

nat (outside) 1 192.168.3.0 255.255.255.0

access-group InsideACL in interface inside



0

Featured Post

New Tabletop Appliances Blow Competitors Away!

WatchGuard’s new T15, T35 and T55 tabletop UTMs provide the highest-performing security inspection in their class, allowing users at small offices, home offices and distributed enterprises to experience blazing-fast Internet speeds without sacrificing enterprise-grade security.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you’re involved with your company’s wide area network (WAN), you’ve probably heard about SD-WANs. They’re the “boy wonder” of networking, ostensibly allowing companies to replace expensive MPLS lines with low-cost Internet access. But, are they …
WARNING:   If you follow the instructions here, you will wipe out your VTP and VLAN configurations.  Make sure you have backed up your switch!!! I recently had some issues with a few low-end Cisco routers (RV325) and I opened a case with Cisco TA…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Suggested Courses

865 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question