i-pad anyconnect problem with ip address

werowance · ‎01-11-2012

i can connect a users ipad just fine using anyconnect however they can not connect to any resource on the company network.

i found that the users home network was also using 192.168.1.xxx the same as my company's network. my firewall is assiging 172.16.16.xxx to vpn clients.

if i change my users home network to something other than 192.168.1.xxx eg 10.0.0.1, then i can connect to our intrAnet page at work, we can rdp to workstations etc.

my only problem with this work around is 1. im not about to change my companies internal ip scheme just for 1 or 2 users.

2. these users will likely use internet from different locations, which most access points are 192.168.1.xxx ip schemes at hotels and confrence centers etc.

so is their any way to force the i-pad to send all trafic over the vpn tunnel?

here is some maybe important info

not using certificates (no connect on demand)

not split tunneling, so web browsing on home internet not allowed while connected to vpn

using rsa tokens

asa 5500 firewall

my ssl is self signed not a store bought one from verisign or something like that.

thanks in advance for any info.

andrew.prince · ‎01-11-2012

Nat your internal network over the AnyConnect VPN use something like 10.255.255.0/24

Sent from Cisco Technical Support iPad App

werowance · ‎01-12-2012

Well, but what about this: "The AnyConnect Software should use a pool IP from the firewall, so the local network should not matter." the firewall assigns everyone 172.16.16.XXX wouldnt that take care of not having to nat the internal network?

im asking, not arguing. and appreciate all help.

thanks

andrew.prince · ‎01-12-2012

Hi Brian,

I thought your problem is your internal LAN IP Subnet clashes with users home LAN's?? Even if you give them and IP address of 1.1.1.0/24 when they want to access something over the VPN to your internal LAN, and that IP address happens to be the same as their home network - it will fail!

werowance · ‎01-12-2012

Ah, ok, i guess why i am questioning it so much is that a windows pc on the same home network using anyconnect vpn works fine, just the ipad doesnt like it. so i was hopeing it was just an anyconnect setting on the ipad that needed to be changed.

maybe its just the way apple handles networking and vpn differently over a windows computer. ill give the nat a shot. it just takes an act of congress to make a firewall change here at work since we farmed controll of it out to a security company.

andrew.prince · ‎01-12-2012

You know what - if it's not a must have, then don't spend to much time on it!

werowance · ‎01-12-2012

i never siad it wasnt a must have! just said it would take a while to get the changes made and thus posting back results

anyone else out their have an answer as to why a windows pc works fine when using the same ip scheme at home and at work without natting the traffic?

andrew.prince · ‎01-12-2012

ok fair enough - have you enabled logging on the AnyConnect client?

Sent from Cisco Technical Support iPad App