topic Split Tunnel somehow not working in Network Security

Split Tunnel somehow not working

JesseRely — Mon, 11 Mar 2019 22:31:14 GMT

Hello,

At our client I configured Split Tunneling on an ASA but somehow it doesn't seem to function.

I have the feeling I'm missing something but I don't see what.

Situation as followed:

Network: 10.38.11.192 255.255.255.224

group-policy VPNCLIENTS attributes

dns-server value 10.38.11.203

split-tunnel-policy tunnelspecified

split-tunnel-network-list value Split_Tunnel_VDDnew

access-list Split_Tunnel_VDD standard permit 10.38.11.192 255.255.255.224

ip local pool VPNDHCP 10.38.12.1-10.38.12.100

I don't see what is wrong here since the same setup is used at other clients.

Hope someone can help.

Greetings Jesse

Split Tunnel somehow not working

andrea.meconi — Fri, 17 Feb 2012 10:59:37 GMT

Please verify your ACL name.

Andrea

Split Tunnel somehow not working

JesseRely — Fri, 17 Feb 2012 11:04:45 GMT

Woops, copied an old ACL, correct split-tunnel list:

access-list Split_Tunnel_VDDnew extended permit ip 10.38.11.192 255.255.255.224 10.38.12.0 255.255.255.0

Split Tunnel somehow not working

andrea.meconi — Fri, 17 Feb 2012 11:27:15 GMT

Hello Jesse.

You can use the standard ACL to specify the network behind the ASA.

Can you remove the NAT statement, please?

Split Tunnel somehow not working

JesseRely — Fri, 17 Feb 2012 12:15:34 GMT

Sorry, should have mentioned it before but I'm fairly new to this.

Isn't the NAT statement mandatory since my external adres is bound to it?

Also what do you mean with standard ACL, or does NAT look at the standard ACL once you remove it?

Again sorry, I started doing ASA's and PIX's recently and find them awefully cryptic sometimes.

Split Tunnel somehow not working

andrea.meconi — Fri, 17 Feb 2012 12:59:41 GMT

Jesse,

have a look here,

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080702999.shtml#s2.

Hope this help.

Regards.

Andrea

Split Tunnel somehow not working

JesseRely — Fri, 17 Feb 2012 13:15:30 GMT

Hi Andrea,

That's the ironic part, I followed that manual exactly. I even had our Senior Network Engineer take a loot at it and also said "Weird... it should work".

Therefor I have the feeling I'm missing something.

Split Tunnel somehow not working

andrea.meconi — Fri, 17 Feb 2012 13:28:59 GMT

Can you provide all VPN configuration?

Have you set the default group policy when define the tunnel-group?

tunnel-group XXXXXXX general-attributes

default-group-policy VPNCLIENTS

Split Tunnel somehow not working

JesseRely — Fri, 17 Feb 2012 15:44:29 GMT

Ok, thanks for the response, I am currently unable to log onto the ASA. I'll get back to you once I'm able to.

Split Tunnel somehow not working

mvsheik123 — Fri, 17 Feb 2012 15:48:30 GMT

Hi Jesse,

The config looks fine. When you say it is not working - what exctly the issue? VPN clients unable to access the internal network? Few things you need to check...

1. nat 0 access-list for internal network to remote von client subnet.

2. same security traffic permit intra/inter interface allowed. (check the syntax for this command).

3. Route on internal routers that points the traffic to VPN subnets to ASA inside interface. (default should do as well).

hth

Split Tunnel somehow not working

Julio Carvajal — Fri, 17 Feb 2012 18:45:30 GMT

Hello Jesse,

Andrea advise ( Default-group-policy) should do it.

If that does not make a difference please post entire configuration.

Regards,

Split Tunnel somehow not working

JesseRely — Mon, 20 Feb 2012 08:55:04 GMT

Sorry for the long response, I'm at a different client today and not able to provide answers untill tomorrow.