Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 747
  • Last Modified:

Cisco AnyConnect Tunnel Question

I have a Cisco ASA 5510 configured with AnyConnect VPN that tunnels only our internal networks.

We have a remote webfarm that hosts a development instance of our websites that can only be accessed by public IP which is controlled by an ACL to prevent search engines from crawling our development sites.  Our ASA has a global outside IP that is allowed in the development ACL.  When our VPN clients connect since all public networks are split from the VPN tunnel when they attempt to connect to the development sites they're denied by the ACL since their IP is unknown.  

I would like to tunnel this public network through the VPN while still splitting all other traffic to their own i-net connections.  Guru help please!

Thanks in advance!
0
nathanspowell
Asked:
nathanspowell
  • 6
  • 5
  • 2
1 Solution
 
TheTullCommented:
Sounds to me like you want to setup a split-tunnel so that traffic from VPN users destined to the remote webfarm will get passed through your corporate firewall and not through the user's own Internet connection.

Have you tried setting up split-tunnling on the ASA, which, in a nutshell, has you setup an ACL that permits traffic to the webfarm, which then has the result of setting up a route in the local routing table of the client's PC so that traffic so that IP gets sent to the ASA and not out the user's ISP.  

Here is a good Cisco page on setting up split-tunneling:  http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080975e83.shtml

Keep in mind there are risks involved with split-tunneling, which are described here: http://www.cisco.com/web/about/security/intelligence/05_08_SSL-VPN-Security.html
0
 
nathanspowellAuthor Commented:
I have setup a split tunnel for that network on the VPN profile.  However, when the vpn is established now it just kills all connectivity to that subnet.  Something is missing.

Here are a few more config details.

Tunnel
VPN <-> Internal subnets (Nat exemptions) Works fine
VPN <-> External public subnet (No Nat exemptions) doesn't work

Inside network 10.10.10.0/24
VPN network 10.10.1.0/24

global (outside) 10 interface
0
 
TheTullCommented:
Can you confirm if the VPN traffic is NATing to the external interface once it leaves the firewall to get to the webfarm, or, better yet, is the ASA attempting to route the VPN traffic out the external interface at all?
0
Choose an Exciting Career in Cybersecurity

Help prevent cyber-threats and provide solutions to safeguard our global digital economy. Earn your MS in Cybersecurity. WGU’s MSCSIA degree program was designed in collaboration with national intelligence organizations and IT industry leaders.

 
nathanspowellAuthor Commented:
Translation doesn't appear to be happening.  When I try to hit the webfarm from a VPN client I do a show xlate on the ASA and I don't see any translations for the 10.10.1 vpn subnet in the list.  If there's another way I should check this let me know.
0
 
TheTullCommented:
I'm guessing you have to setup a NAT entry for the VPN traffic when it's leaving the outside interface, and also "allow" it to come in and out the same interface, so like this:

asa(config)# same-security-traffic permit intra-interface
asa(config)# global (outside) 1 interface (you may already have this line entered)
asa(config)# nat (outside) 1 10.10.1.0 255.255.255.0

I haven't run that config before, so I would make sure you can test it OK without screwing anything up, which you should be able to really, so long as you have local access to the ASA.  
0
 
nathanspowellAuthor Commented:
asa(config)# same-security-traffic permit intra-interface
asa(config)# global (outside) 1 interface (you may already have this line entered)

were both already on our ASA.

asa(config)# nat (outside) 1 10.10.1.0 255.255.255.0

I added, and disconnected/reconnected the VPN.  Still have the same issue, websites not pulling via the tunnel and no xlates for 10.10.1.x on the ASA.

I've attached a sterilized copy of the config.
corp-current-sterile.txt
0
 
MikeKaneCommented:
What are the IP ranges of the remote webfarm?
0
 
MikeKaneCommented:
ACtually, probably better you don't specify.      But whatever those ranges are, you need to include them in the split tunnel ACL so that those ranges also get swept into the tunnel from client to HQ, and then outbound using the HQ external interface...  


Either that or just remove the split tunnel all together....
0
 
nathanspowellAuthor Commented:
@MikeKane

I'm not providing the specific IP range on a public forum, but lets call it:

201.201.201.0 / 24

I can decypher any instruction into the actual IP range on my end.

In case your asking in regard to the config I attached and the current split...
The last line in this sections represents the remote network.

access-list SSL_Split standard permit 10.10.10.0 255.255.255.0
access-list SSL_Split standard permit 10.10.30.0 255.255.255.0
access-list SSL_Split standard permit 10.10.70.0 255.255.255.0
access-list SSL_Split standard permit 10.10.92.0 255.255.255.0
access-list SSL_Split standard permit 10.10.48.0 255.255.248.0
access-list SSL_Split standard permit 10.10.40.0 255.255.255.0
access-list SSL_Split standard permit 10.10.20.0 255.255.255.0
access-list SSL_Split standard permit 10.10.115.0 255.255.255.0
access-list SSL_Split standard permit 10.0.0.0 255.255.0.0
access-list SSL_Split standard permit 10.10.60.0 255.255.254.0
access-list SSL_Split standard permit 10.100.1.0 255.255.255.0
access-list SSL_Split standard permit 201.201.201.0 255.255.255.0
0
 
nathanspowellAuthor Commented:
The range is in the split.  I don't want to remove the split as I would prefer all i-net bound traffic except this range use the clients connection.
0
 
TheTullCommented:
Change your config line from

asa(config)# nat (outside) 1 10.10.1.0 255.255.255.0

to

asa(config)# nat (outside) 10 10.10.1.0 255.255.255.0

The "nat" group needs to match the global group, and the global is using "10" while the nat is using "1"
0
 
nathanspowellAuthor Commented:
You sir are correct, it's a beautiful thing!

Thanks!
0
 
TheTullCommented:
Cool!  Glad I could help :)
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

IT Degree with Certifications Included

Aspire to become a network administrator, network security analyst, or computer and information systems manager? Make the most of your experience as an IT professional by earning your B.S. in Network Operations and Security.

  • 6
  • 5
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now