topic Re: Split tunneling question in Network Security

Split tunneling question

vishnuvichu36601 — Fri, 21 Feb 2020 15:40:58 GMT

We were using a split-tunnelling in our office. So users got office network and internet using their own home network. We need to use office network and internet using the office network.We need to monitor internet traffic also in Cisco ASA of VPN-users.

Re: Split tunneling question

Marius Gunnerud — Sun, 29 Apr 2018 09:39:09 GMT

Just set up the AnyConnect VPN to tunnel all traffic then configure a dynamic NAT policy for outside to outside for the AnyConnect subnet. now you should be able to see the connections through the ASA.

Re: Split tunneling question

vishnuvichu36601 — Mon, 30 Apr 2018 03:03:22 GMT

nat (outside,outside) source static obj-AnyconnectPool obj-AnyconnectPool destination
 static obj-AnyconnectPool obj-AnyconnectPool

this is the configuration you are talking about?turn off the split-tunelling and tunelling all.????

Re: Split tunneling question

Marius Gunnerud — Mon, 30 Apr 2018 07:44:40 GMT

No that is part of the configuration for hairpinning the VPN traffic out to the internet. in addition to this you need the command same-security-traffic permit intra-interface

For changing the configuration to tunnel-all you would need to change the group-policy configuration

group-policy AnyConnect_GrpPolicy internal

group-policy AnyConnect_GrpPolicy attributes

split-tunnel-policy tunnelall

tunnel-group AnyConnect type remote-access

tunnel-group AnyConnect general-attributes

default-group-policy AnyConnect_GrpPolicy

Re: Split tunneling question

vishnuvichu36601 — Mon, 30 Apr 2018 08:45:15 GMT

group-policy AnyConnect_GrpPolicy internal

group-policy AnyConnect_GrpPolicy attributes

split-tunnel-policy tunnelall

tunnel-group AnyConnect type remote-access

tunnel-group AnyConnect general-attributes

default-group-policy AnyConnect_GrpPolicy

After this we need to write a NAT policy for outside for VPN Network to access internal network and office internet without using Client home ISP

Re: Split tunneling question

Marius Gunnerud — Mon, 30 Apr 2018 08:48:52 GMT

That is correct. Keep in mind that you also need the command same-security-traffic permit intra-interface

Re: Split tunneling question

vishnuvichu36601 — Wed, 02 May 2018 08:53:50 GMT

Current senario we configured "same-security-traffic permit inter-interface".Can we configure both in asa same-security-traffic permit inter and intra interface?

Test plan is that.

Create a new group-policy and applied tunnel all and do a dynamic nat for vpn subnet outside outside.Is this step ok for testing???please help

Re: Split tunneling question

Marius Gunnerud — Wed, 02 May 2018 12:22:05 GMT

you can have both same-security-traffic permit inter-interface and same-security-traffic permit intra-interface configured at the same time.

Create a new group-policy and applied tunnel all and do a dynamic nat for vpn subnet outside outside.Is this step ok for testing???

Yes, this plus the same-security-traffic permit intra-interface command will allow hairpinning for AnyConnect.