Can't SSH into ASA after configuring EZVPN and not specifying "split-tunnel-policy tunnelspecified"

[baskervi]

Even after specifying "split-tunnel-policy tunnelspecified" with "split-tunnel-network-list value SPLIT-TUNNEL" and denying all traffic to/from the public IP of the ASA, I'm still not able to SSH into the firewall. Everything else appears to be working OK, but I need to be able to manage the ASA from the public interface. Actually, I kind of expect this given the say an sa is setup for the tunnel, and it would seem that a deny statement would be ignored, but maybe there is a way around this. Thank you.

[Karsten Iwen · Accepted solution]

If you want to connect to your inside IP through the tunnel, you need to specify "management access inside":

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/access_management.html#wp1064497

regards, Karsten

Sent from Cisco Technical Support iPad App