Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Attention: The Community will be in read-only mode on 12/14/2017 from 12:00 am pacific to 11:30 am.

During this time you will only be able to see content. Other interactions such as posting, replying to questions, or marking content as helpful will be disabled for few hours.

We apologize for the inconvenience while we perform important updates to the Community.

New Member

Cisco AnyConnect SSL VPN no split tunnel and no hairpinning internet access

Greetings,

 

I am looking to configure a Cisco ASA 5515X for Cisco AnyConnect Essentials SSL VPN where ALL SSL-VPN traffic is tunneled, no split tunneling or hairpinning on the outside interface. However users require internet access. I need to route traffic out the "trusted" or "inside" interface to another device that performs content-filtering and inspection which then egresses out to the internet from there. Typically this could be done using a route-map (which ASA's do not support) or with a VRF (again, not an option on the ASA). The default route points to the outside interface toward the internet.

 

Is there no other method to force all my SSL-VPN traffic out the inside interface toward LAN subnets as needed and have another default route point toward the filtering device?

OR 

Am I forced to put the ASA behind the filtering device somehow?

Everyone's tags (1)
4 REPLIES
Cisco Employee

Hi Jim, You can use tunnel

Hi Jim,

 

You can use tunnel default route for vpn traffic:

ASA(config)# route inside 0.0.0.0 0.0.0.0 <inside hop> tunneled

configure mode commands/options:
  <1-255>   Distance metric for this route, default is 1
  track     Install route depending on tracked item
  tunneled  Enable the default tunnel gateway option, metric is set to 255

 

This route is applicable for only vpn traffic.

 

HTH,

Shetty

New Member

I know this is a old post,

I know this is an old post, but I am curious to know if the route with tunneled keyword is the right fix to send all internet traffic out from inside interface of VPN to an attached layer 3 device that knows internet routes. I tried it today but didn't work. VPN users can reach all internal, dmz resources but not Internet. The trace dies at vpn and packet-tracer drops at WEBVPN-SVC.

-Josh

Cisco Employee

Hi Joshuskarki,

Hi Joshuskarki,

Following doc explains the use of tunnel-default route:

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/112182-ssl-tdg-config-example-00.html

All it does it forward the packets received from tunnel to gateway mentioned in tunnel-default route. If the traffic fails , then troubleshoot it like any other traffic on upstream devices.

Key thing would to make sure upstream device(before ISP) knows routing info of VPN pool, so return traffic can be forwarded back onto ASA.

Do capture on ASA internal interface to check if its forwarding the request packets and receiving reply or not.

BR

Santhosh

New Member

Thanks for your quick reply,

Thanks for your quick reply, Santosh!

If I know any public addresses eg, 4.2.2.2 or 8.8.8.8 and configure static routes pointing them to next-hop towards inside interface, it works just fine. VPN users can ping these addresses. That confirms the NAT, return routes from internet router to VPN address pool is all good. It is just the route with tunneled as the link explained doesn't seem to be working in my environment. I am sure I am missing something obvious somewhere in the config. 

My setup has few other groups with split-tunneling on and that have been working fine. 

The one (new group) I am currently testing is tunnel-all traffic with VPN always-on. Always-on seems to be working and I can reach to internal resources also but the traffic isn't going out internet :(

-Josh

1127
Views
0
Helpful
4
Replies
CreatePlease to create content