I believe this question has been addressed before, but I need clarification. Can VPN clients terminated by the same device (ASA) who obviously sit on the same subnet, commnicate directly with one another? In my current setup I cannot ping or browse between connected clients. I need traffic between them to have my IP Communicators call and speak to each other successfully.
Yes, it now works for us, but I had to open a TAC case to really get to the bottom of things and clear it up.
Basically you enter the "same-security-traffic permit intra-interface" command in global config. I found out you also have to include the network of the vpn pool on the split-tunneling ACl for the split tunnel network list that you want to be able to do this. My vpn pool is 172.25.1.0 /24, so my statement was:
Access-list ABC_splitTunnelACL standard permit 172.25.1.0 255.255.255.0
I could then ping from client to client. I hope this makes sense.
Hello. I just found this post and I need to accomplish the same thing (two vpn clients communicating directly with each other). I found a document that talked about setting up split tunneling through group policy, tunnel group policy and an ACL defining the internal network. From what you said it sounds as if the ACL should actually define the addresses from the VPN pool. What commands did you have to use to get this to work and could you please confirm that you used the VPN pool addresses for the ACL and not the internal network. Using the VPN pool seems like it should work (i had been wondering about using the internal addresses) but I just wanted to know for sure.
After you defined the split tunneling then you put in the command "same-security-traffic permit intra-interface" and it worked?
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...