Cisco ASA Remote Access VPN IPSec Non-split Tunnel

A friend is trying to set it up such that some of his users will send ALL of their traffic down the tunnel including Internet traffic down through the tunnel.  He's gotten it to the point where the tunnel allows access to internal resources.  But there is no Internet access.  What has to be configured so that the traffic will turn around and get out to the Internet and back to the tunneled user's PC?
LVL 1
amigan_99Network EngineerAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
fgasimzadeConnect With a Mentor Commented:
global (outside) 2 interface

nat (outside) 2 192.168.47.0 255.255.255.0
0
 
John HurstBusiness Consultant (Owner)Commented:
I do not understand your subject.

Set up the client profile to use split tunneling. That is the simplest way and it works. All the client has to do is to disable VPN to use internet and then hook the VPN back up when they need to work.

It is just easiest to permit split tunneling.

If your client insists, they have to provide a server at the remote end with IE on it. It will be pathetically slow, but it will work.

... Thinkpads_User
0
 
amigan_99Network EngineerAuthor Commented:
He does not want to permit split tunnel VPN - only non-split.  And even traffic to the Internet he wants to go first to the ASA and then go on its way to the Internet.  I have set this up in the past and was hoping someone here could give me the key steps to get it working without my pawing and experimenting.
0
Will You Be GDPR Compliant by 5/28/2018?

GDPR? That's a regulation for the European Union. But, if you collect data from customers or employees within the EU, then you need to know about GDPR and make sure your organization is compliant by May 2018. Check out our preparation checklist to make sure you're on track today!

 
amigan_99Network EngineerAuthor Commented:
Here is a discussion saying it is possible..

https://supportforums.cisco.com/thread/2187367

Not sure I get how this would be implemented with the ASDM
0
 
fgasimzadeCommented:
You would need to configure NAT and this command

same-security-traffic permit intra-interface
0
 
amigan_99Network EngineerAuthor Commented:
So assuming a VPN pool 192.168.47.0 - the nat might look like..


global (outside) 2 interface

nat (outside) 2 192.168.47.0 255.255.255.0 outside


??
0
 
amigan_99Network EngineerAuthor Commented:
Or

global (inside) 2 interface

nat (outside) 2 192.168.47.0 255.255.255.0 outside

?
0
 
amigan_99Network EngineerAuthor Commented:
Much appreciated!  It worked.
0
All Courses

From novice to tech pro — start learning today.