Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

NAT rule for vpn access..?

Hi, trying to set up ssl vpn via Anyconnect client on a new ASA 5510, ASA 8.4.2, ASDM 6.4.5.

I am able to successfully 'connect' via the anyconnect client, & I am assigned an ip from the vpn pool I created, however I can't ping or connect to any of the internal servers.

I think I've set up split tunnelling ok following the guide below, as I can browse the web nice & fast while logged in to vpn but just can't find anything on the internal network.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080975e83.shtml

I suspect its down to a nat rule but I'm a bit stuck whether it should be a network object nat rule or if it shoud be dynamic/static & whether its between the outside interface or external ip & the inside network or the vpn network (I created the pool on a separate subnet), or a 'range' (but then I get overlapping ip errors when I try to create a rule for a range of IPs.

Any advice much appreciated,

1 ACCEPTED SOLUTION

Accepted Solutions
New Member

Re: NAT rule for vpn access..?

Hi Eunson,

After you have connected to the ASA the clients get an IP address of let's say 192.168.10.0/24 pool, the network behind the ASA is 192.168.20.0/24.

On the ASA you would need a NAT exemption for 192.168.20.0 to 192.168.10.0

Create two object groups, for VPN pool and for your itnernal LAN.

object-group network object-192.168.20.0

network-object 192.168.20.0 255.255.255.0

object-group network object-192.168.10.0

network-object 192.168.10.0 255.255.255.0

nat (inside,outside) 1 source static object-192.168.20.0 object-192.168.20.0 destination static object-192.168.10.0 object-192.168.10.0 no-proxy-arp route-lookup

Inside = The interface behind which your LOCAL lan is

Outside = The interface on which the Clients connect.

If you cannot still access then you can take captures on the Inside interface,

create and acl

access-list test123 permit ip host x.x.x.x host y.y.y.y

access-list test123 permit ip host y.y.y.y host x.x.x.x

capture test123 interface inside access-list test123

show cap test123

It will show if packets are going out through the inside interface and if we see any replies or not. If we don't see any replies it means that there might be a routing issue on the internal LAN as the devices might not know to route traffic for 192.168.10.0 back to the ASA inside interface.

Or it might be that there would be a firewall dropping packets in your internal lan.

HTH

2 REPLIES
New Member

Re: NAT rule for vpn access..?

Hi Eunson,

After you have connected to the ASA the clients get an IP address of let's say 192.168.10.0/24 pool, the network behind the ASA is 192.168.20.0/24.

On the ASA you would need a NAT exemption for 192.168.20.0 to 192.168.10.0

Create two object groups, for VPN pool and for your itnernal LAN.

object-group network object-192.168.20.0

network-object 192.168.20.0 255.255.255.0

object-group network object-192.168.10.0

network-object 192.168.10.0 255.255.255.0

nat (inside,outside) 1 source static object-192.168.20.0 object-192.168.20.0 destination static object-192.168.10.0 object-192.168.10.0 no-proxy-arp route-lookup

Inside = The interface behind which your LOCAL lan is

Outside = The interface on which the Clients connect.

If you cannot still access then you can take captures on the Inside interface,

create and acl

access-list test123 permit ip host x.x.x.x host y.y.y.y

access-list test123 permit ip host y.y.y.y host x.x.x.x

capture test123 interface inside access-list test123

show cap test123

It will show if packets are going out through the inside interface and if we see any replies or not. If we don't see any replies it means that there might be a routing issue on the internal LAN as the devices might not know to route traffic for 192.168.10.0 back to the ASA inside interface.

Or it might be that there would be a firewall dropping packets in your internal lan.

HTH

New Member

NAT rule for vpn access..?

Thanks Kshitij, that worked perfectly! That was bugging me for weeks, I'm grateful you took the time to explain so clearly & precisely.

244
Views
0
Helpful
2
Replies