Access to LAN Site to Site From ANY Connect on Cisco ASA

[Santimac]

Hello,

I have 2 LANs connected across a VPN Site to Site with 2 Cisco ASA 5500, it is working OK, but on one of the ASAs the AnyConnect users need to connect to the other LAN accross the VPN, is that possible, here are a basic diagram that I made for a better explanation.

Thanks

[Spooster IT Services]

Hi,

Yes, We can do it.

Steps to perform at LAN 1 ASA
1. Add Anyconnect VPN Subnet to Crypto ACL to allow for site to site VPN .
2. Allow access from Anyconnect VPN subnet to LAN2 Subnet in Anyconnect VPN.
3. Add No NAT for Anyconnect VPN Subnet.

Steps to perform at LAN 2 ASA
1. Add Anyconnect VPN Subnet to Crypto ACL to allow for site to site VPN .

[Santimac]

Could you explain me a little bit more step 2?

2. Allow access from Anyconnect VPN subnet to LAN2 Subnet in Anyconnect VPN. 

In Anyconnect?

Thanks

[Spooster IT Services]

That looks to be some typo, You can check now.

[santimac88]

Do I need to add a Route on the ASA LAN 1 to the LAN 2? I dont think so because the connection is on the same FW.

I think I already added the NAT Exemption but still not working.

[Rob Ingram]

Hi,
Yes this is possible.

You need to add the AnyConnect VPN Pool network to the crypto ACL on both ASAs.
You will also need to add a no-NAT/NAT exemption rule on the LAN1 ASA to ensure the traffic from the AnyConnect VPN Pool to the LAN2 network(s) is not NATTED.

HTH

[Santimac]

How can I add the NO-NAT/NAT Rule, at this moment, this the the rule that has been created on automatically after I created the VPN Site to Site. Where am I going to create that rule on?

[santimac88 · Accepted solution]

Solution to this:

Steps to perform at LAN 1 ASA
1. Add Anyconnect VPN Subnet to Crypto ACL to allow for site to site VPN .
2. Allow access from Anyconnect VPN subnet to LAN2 Subnet in Anyconnect VPN.
3. Add No NAT for Anyconnect VPN Subnet.

Steps to perform at LAN 2 ASA
1. Add Anyconnect VPN Subnet to Crypto ACL to allow for site to site VPN .

Run these commanbds
- same-security-traffic permit intra-interface

- same-security-traffic permit inter-interface