VPN ssl cannot access internet

[Sylphide]

Hello guys!

I need help to allow access to internet for my vpn users. I can connect with Anyconnect but have no internet access. Subnet for VPN is 192.168.100.0. I have allowed this subnet on my cisco router.

ISP -> Router (887VA) -> 192.168.0.0 -> ASA -> 192.168.1.0

Here is my config :

ASA Version 9.1(3)

ip local pool AnyConnect 192.168.100.1-192.168.100.254 mask 255.255.255.0

object network NETWORK_OBJ_192.168.100.0_24

subnet 192.168.100.0 255.255.255.0

nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 no-proxy-arp route-lookup

ssl trust-point VPN outside

ssl trust-point VPN inside

webvpn

enable inside

enable outside

anyconnect image disk0:/anyconnect-win-3.1.04072-k9.pkg 1

anyconnect enable

tunnel-group-list enable

group-policy DfltGrpPolicy attributes

vpn-tunnel-protocol ikev2 l2tp-ipsec

group-policy GroupPolicy_VPN internal

group-policy GroupPolicy_VPN attributes

wins-server none

vpn-tunnel-protocol ssl-client

split-tunnel-policy tunnelall

username alex attributes

vpn-group-policy GroupPolicy_VPN

tunnel-group VPN type remote-access

tunnel-group VPN general-attributes

address-pool AnyConnect

default-group-policy GroupPolicy_VPN

tunnel-group VPN webvpn-attributes

group-alias VPN enable

Thank you very much!    

[Jouni Forss]

Hi,

You could try changing your NAT configurations a bit.

object network LAN

subnet 192.168.1.0 255.255.255.0

object network VPN-POOL

subnet 192.168.100.0 255.255.255.0

nat (inside,outside) source static LAN LAN destination static VPN-POOL VPN-POOL

nat (outside,outside) after-auto source dynamic VPN-POOL interface

no nat (inside,outside) source static any any destination static  NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 no-proxy-arp  route-lookup

You might even be fine by just adding one of the above and removing the current one

nat (inside,outside) source static LAN LAN destination static VPN-POOL VPN-POOL

no  nat (inside,outside) source static any any destination static   NETWORK_OBJ_192.168.100.0_24 NETWORK_OBJ_192.168.100.0_24 no-proxy-arp   route-lookup

I think the current traffic from VPN Client to the Internet might match the current NAT configuration and forward it to the LAN instead of towards your ISP router so changing the existing rule might help. The first suggestion above aims to configure NAT0 for the LAN to VPN traffic and PAT the traffic from the VPN user towards the Internet to the external interface of the ASA. I presume this address has a PAT rule again on the ISP router?

- Jouni

[Sylphide]

Hi Jouni,

Thank you, I will try it.

Yes I have a PAT rule on my router :

ip nat inside source list 101 interface Ethernet0 overload

ip nat inside source static tcp 192.168.0.2 443 interface Ethernet0 443

ip nat inside source static tcp 192.168.1.3 80 interface Ethernet0 80

access-list 101 permit ip 192.168.0.0 0.0.0.255 any

access-list 101 permit ip 192.168.1.0 0.0.0.255 any

access-list 101 permit ip 192.168.100.0 0.0.0.255 any

[Sylphide]

Still no internet.

Do I need to add an access-list for VPN-POOL?

Default gateway is automatically 192.168.100.2 (cannot ping it when connected). Maybe this is a problem too?

[Jouni Forss · Accepted solution]

Hi,

Check that you have this configuration

same-security-traffic permit intra-interface

You can check it with

show run same-security-traffic

If you dont have it then add it and test again.

If it doesnt work after this then confirm if your Router is seeing any of this traffic. For example do you see any NAT translations on the Router for your VPN users?

Which NAT configuration did you use to test? I suggest 2 different options above.

First one was to change the current VPN Client NAT0 configuration and adding Dynamic PAT for VPN users towards the Internet.

Second one was just to change the NAT0 configuration

- Jouni

[Sylphide]

same-security-traffic permit intra-interface has solved my problem!

Thanks again.

[Jouni Forss]

Hi,

Glad to hear you got it working

I forgot to mention that command originally even though its essential to get a setup such as your working.

- Jouni