topic Re: ASA with two WebVPN interfaces in Network Security

ASA with two WebVPN interfaces

Pavel Pokorny — Tue, 21 Jan 2020 11:51:58 GMT

Dear all,

Please advice, what are possibilities.

AsIs situation: ASA with webvpn configured on outside interface. This is pretty standard solution which is working for many years.

ToBe situation: add possibility to connect via VPN client on inside interface. But here comes the trick. I would like to have (on this new headend) different tunnel-groups and with this also different ip-pool for clients.

Is it even possible (9.8 version)?

Kind regards,

Pavel

Re: ASA with two WebVPN interfaces

Rob Ingram — Tue, 21 Jan 2020 13:37:05 GMT

Hi,
Yes this should be possible. You would need to:-

- Enabled SSL/IKEv2 IPSec on the INSIDE interface.
- Create additional IP Pools
- Create a new Group Policy, reference the new IP Pool within the Group Policy
- Create a new tunnel group, reference the new group policy within the tunnel group.

You should then connect to the new tunnel group and receive an IP address from the new IP Pool. You would probably also need a new NAT exemption rule to ensure traffic from the new IP Pool to the local internal network is not natted.

If you need further assistance please upload your configuration.
HTH

Re: ASA with two WebVPN interfaces

Pavel Pokorny — Tue, 21 Jan 2020 14:38:14 GMT

Hi,

Thanks for quick reply.

One more demand.

Let's say, on current webvpn I have tunnel-group 12345.

I will create new one (for inside) 54321.

But, what I need, is:

1) from outside I will see (in client) only 12345

2) from inside I will see (in client) only 54321

There will be no possibility to use tunnel-group 54321 from outside and vice versa.

I cannot find any solution, to limit tunnel-groups in that way.

Kind regards,

Pavel