Cisco ASA 5525 Client VPN

[jthombs1016]

Hello all

I have a strange issue with a new client VPN. When I connect to the VPN  I am unable to ping  the inside interface or browse the  Internet. I have attached the firewall configuration. can any spot what I am missing?

Thanks

[Rahul Govindan]

2 issues:

1) Internet access: Your VPN is not set up for Split tunneling. That means all traffic from your PC is going to be sent to the ASA, which includes internet. If you want to access internet through the ASA, you need to create NAT rules to u-turn the traffic on the outside interface.

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/100918-asa-sslvpn-00.html#anc6

If you want split-tunnel, you need to create the split-tunnel policy and apply it to the group-policy as shown below:

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/119006-configure-anyconnect-00.html#anc9

2) Inside interface access: Your management access is set to the Management interface.

management-access Management

This setting is required for VPN users to be able to ping or ssh to a particular interface. You can only set one interface for management-access, so changing to Inside will allow you to ping the Inside interface. 

[jthombs1016]

Thanks Rahul what would the NAT rule look like. I would like to have all the internet traffic through the firewall.

[Rahul Govindan]

NAT rule would look something like below. Pool object and ip address should be the object name you used in your config.

ciscoasa(config)# object network obj-AnyconnectPool
ciscoasa(config-network-object)# subnet 192.168.10.0 255.255.255.0
ciscoasa(config-network-object)# nat (outside,outside) dynamic interface

You would also need the below command for u-turning:

ciscoasa(config)#same-security-traffic permit intra-interface

This is documented in the link I pasted before:

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/100918-asa-sslvpn-00.html#anc6

[jthombs1016]

I am now connected to VPN.  I cant browse or ping  the Internet .  Am I missing some access rules ?