Internet access VPN clients

Rutger Blom · ‎03-04-2010

Hello,

We have some 3002 VPN clients that need Internet access through the established VPN tunnel. The problem is that the ASA5520's external interface is blocking this traffic. It seems like it doesn't allow outbound traffic over the same external interface as where the VPN tunnel is terminated.

Is there some way we can solve this?

Kind regards,

Rutger

Collin Clark · ‎03-04-2010

There sure is-

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807fc191.shtml#Same

Hope it helps.

Rutger Blom · ‎03-04-2010

Thanks Collin,

I can't seem to find our particular scenario in that document. We have VPN clients coming in on the external interface and moving out via the same external interface to access Internet. The external interface blocks this traffic probably because it sees the same MAC address on both sides of its interface (outside and inside).

Kind regards,

Rutger

Collin Clark · ‎03-04-2010

Rutger-

You will need the same security statement and you may be missing NAT as well. If you can, post some of your logs when a user tries to access the internet.