Cisco ASA Remote Access VPN IPSec Non-split Tunnel

A friend is trying to set it up such that some of his users will send ALL of their traffic down the tunnel including Internet traffic down through the tunnel.  He's gotten it to the point where the tunnel allows access to internal resources.  But there is no Internet access.  What has to be configured so that the traffic will turn around and get out to the Internet and back to the tunneled user's PC?
LVL 1
amigan_99Network EngineerAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
fgasimzadeConnect With a Mentor Commented:
global (outside) 2 interface

nat (outside) 2 192.168.47.0 255.255.255.0
0
 
JohnBusiness Consultant (Owner)Commented:
I do not understand your subject.

Set up the client profile to use split tunneling. That is the simplest way and it works. All the client has to do is to disable VPN to use internet and then hook the VPN back up when they need to work.

It is just easiest to permit split tunneling.

If your client insists, they have to provide a server at the remote end with IE on it. It will be pathetically slow, but it will work.

... Thinkpads_User
0
 
amigan_99Network EngineerAuthor Commented:
He does not want to permit split tunnel VPN - only non-split.  And even traffic to the Internet he wants to go first to the ASA and then go on its way to the Internet.  I have set this up in the past and was hoping someone here could give me the key steps to get it working without my pawing and experimenting.
0
NEW Internet Security Report Now Available!

WatchGuard’s Threat Lab is a group of dedicated threat researchers committed to helping you stay ahead of the bad guys by providing in-depth analysis of the top security threats to your network.  Check out this quarters report on the threats that shook the industry in Q4 2017.

 
amigan_99Network EngineerAuthor Commented:
Here is a discussion saying it is possible..

https://supportforums.cisco.com/thread/2187367

Not sure I get how this would be implemented with the ASDM
0
 
fgasimzadeCommented:
You would need to configure NAT and this command

same-security-traffic permit intra-interface
0
 
amigan_99Network EngineerAuthor Commented:
So assuming a VPN pool 192.168.47.0 - the nat might look like..


global (outside) 2 interface

nat (outside) 2 192.168.47.0 255.255.255.0 outside


??
0
 
amigan_99Network EngineerAuthor Commented:
Or

global (inside) 2 interface

nat (outside) 2 192.168.47.0 255.255.255.0 outside

?
0
 
amigan_99Network EngineerAuthor Commented:
Much appreciated!  It worked.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.