?
Solved

Cisco AnyConnect Tunnel Question

Posted on 2011-03-21
13
Medium Priority
?
738 Views
Last Modified: 2012-05-11
I have a Cisco ASA 5510 configured with AnyConnect VPN that tunnels only our internal networks.

We have a remote webfarm that hosts a development instance of our websites that can only be accessed by public IP which is controlled by an ACL to prevent search engines from crawling our development sites.  Our ASA has a global outside IP that is allowed in the development ACL.  When our VPN clients connect since all public networks are split from the VPN tunnel when they attempt to connect to the development sites they're denied by the ACL since their IP is unknown.  

I would like to tunnel this public network through the VPN while still splitting all other traffic to their own i-net connections.  Guru help please!

Thanks in advance!
0
Comment
Question by:nathanspowell
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 5
  • 2
13 Comments
 
LVL 7

Expert Comment

by:TheTull
ID: 35182420
Sounds to me like you want to setup a split-tunnel so that traffic from VPN users destined to the remote webfarm will get passed through your corporate firewall and not through the user's own Internet connection.

Have you tried setting up split-tunnling on the ASA, which, in a nutshell, has you setup an ACL that permits traffic to the webfarm, which then has the result of setting up a route in the local routing table of the client's PC so that traffic so that IP gets sent to the ASA and not out the user's ISP.  

Here is a good Cisco page on setting up split-tunneling:  http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080975e83.shtml

Keep in mind there are risks involved with split-tunneling, which are described here: http://www.cisco.com/web/about/security/intelligence/05_08_SSL-VPN-Security.html
0
 

Author Comment

by:nathanspowell
ID: 35182859
I have setup a split tunnel for that network on the VPN profile.  However, when the vpn is established now it just kills all connectivity to that subnet.  Something is missing.

Here are a few more config details.

Tunnel
VPN <-> Internal subnets (Nat exemptions) Works fine
VPN <-> External public subnet (No Nat exemptions) doesn't work

Inside network 10.10.10.0/24
VPN network 10.10.1.0/24

global (outside) 10 interface
0
 
LVL 7

Expert Comment

by:TheTull
ID: 35182946
Can you confirm if the VPN traffic is NATing to the external interface once it leaves the firewall to get to the webfarm, or, better yet, is the ASA attempting to route the VPN traffic out the external interface at all?
0
Moving data to the cloud? Find out if you’re ready

Before moving to the cloud, it is important to carefully define your db needs, plan for the migration & understand prod. environment. This wp explains how to define what you need from a cloud provider, plan for the migration & what putting a cloud solution into practice entails.

 

Author Comment

by:nathanspowell
ID: 35183037
Translation doesn't appear to be happening.  When I try to hit the webfarm from a VPN client I do a show xlate on the ASA and I don't see any translations for the 10.10.1 vpn subnet in the list.  If there's another way I should check this let me know.
0
 
LVL 7

Expert Comment

by:TheTull
ID: 35183144
I'm guessing you have to setup a NAT entry for the VPN traffic when it's leaving the outside interface, and also "allow" it to come in and out the same interface, so like this:

asa(config)# same-security-traffic permit intra-interface
asa(config)# global (outside) 1 interface (you may already have this line entered)
asa(config)# nat (outside) 1 10.10.1.0 255.255.255.0

I haven't run that config before, so I would make sure you can test it OK without screwing anything up, which you should be able to really, so long as you have local access to the ASA.  
0
 

Author Comment

by:nathanspowell
ID: 35183404
asa(config)# same-security-traffic permit intra-interface
asa(config)# global (outside) 1 interface (you may already have this line entered)

were both already on our ASA.

asa(config)# nat (outside) 1 10.10.1.0 255.255.255.0

I added, and disconnected/reconnected the VPN.  Still have the same issue, websites not pulling via the tunnel and no xlates for 10.10.1.x on the ASA.

I've attached a sterilized copy of the config.
corp-current-sterile.txt
0
 
LVL 33

Expert Comment

by:MikeKane
ID: 35183565
What are the IP ranges of the remote webfarm?
0
 
LVL 33

Expert Comment

by:MikeKane
ID: 35183594
ACtually, probably better you don't specify.      But whatever those ranges are, you need to include them in the split tunnel ACL so that those ranges also get swept into the tunnel from client to HQ, and then outbound using the HQ external interface...  


Either that or just remove the split tunnel all together....
0
 

Author Comment

by:nathanspowell
ID: 35183619
@MikeKane

I'm not providing the specific IP range on a public forum, but lets call it:

201.201.201.0 / 24

I can decypher any instruction into the actual IP range on my end.

In case your asking in regard to the config I attached and the current split...
The last line in this sections represents the remote network.

access-list SSL_Split standard permit 10.10.10.0 255.255.255.0
access-list SSL_Split standard permit 10.10.30.0 255.255.255.0
access-list SSL_Split standard permit 10.10.70.0 255.255.255.0
access-list SSL_Split standard permit 10.10.92.0 255.255.255.0
access-list SSL_Split standard permit 10.10.48.0 255.255.248.0
access-list SSL_Split standard permit 10.10.40.0 255.255.255.0
access-list SSL_Split standard permit 10.10.20.0 255.255.255.0
access-list SSL_Split standard permit 10.10.115.0 255.255.255.0
access-list SSL_Split standard permit 10.0.0.0 255.255.0.0
access-list SSL_Split standard permit 10.10.60.0 255.255.254.0
access-list SSL_Split standard permit 10.100.1.0 255.255.255.0
access-list SSL_Split standard permit 201.201.201.0 255.255.255.0
0
 

Author Comment

by:nathanspowell
ID: 35183638
The range is in the split.  I don't want to remove the split as I would prefer all i-net bound traffic except this range use the clients connection.
0
 
LVL 7

Accepted Solution

by:
TheTull earned 2000 total points
ID: 35183640
Change your config line from

asa(config)# nat (outside) 1 10.10.1.0 255.255.255.0

to

asa(config)# nat (outside) 10 10.10.1.0 255.255.255.0

The "nat" group needs to match the global group, and the global is using "10" while the nat is using "1"
0
 

Author Closing Comment

by:nathanspowell
ID: 35183654
You sir are correct, it's a beautiful thing!

Thanks!
0
 
LVL 7

Expert Comment

by:TheTull
ID: 35183678
Cool!  Glad I could help :)
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For months I had no idea how to 'discover' the IP address of the other end of a link (without asking someone who knows), and it drove me batty. Think about it. You can't use Cisco Discovery Protocol (CDP) because it's not implemented on the ASAs.…
During and after that shift to cloud, one area that still poses a struggle for many organizations is what to do with their department file shares.
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…
Suggested Courses

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question