I have cisco ASA firewall. I would like to have secured internet access through client to site vpn. I have configured the following
Inside Interface 192.168.2.0/24
DMZ1-->192.168.3.0/24. This interface connects to the internal interface of the VPN box
DMZ2-->192.168.4.0/24. This interface connects to the external interface of the VPN box
Outside-->192.168.6.1 is the interface IP and for testing i placed a workstation with IP address 192.168.6.2 to test the connectivity.
From inside i connected my system to 192.168.3.2(VPN BOX Inside IP Address) and got authenticated and infact got the VPN Pool of ip address 192.168.9.0/24.
When i try ping reach 192.168.6.2 (System placed in the outside interface) i am not able to
For communication between inside and DMZ1 for VPN authentication i configured the following
static (inside,DMZ1) 192.168.2.0 192.168.2.0
access-list dmzin permit ip 192.168.3.0 255.255.2555.0 192.168.2.0 255.255.255.0
access-group dmzin in interface DMZ1
The above statement wroks fine since i able to connect to the VPN box
In the router i added the statement for reverse route
route DMZ2 192.168.9.0 255.255.255.0 192.168.4.2(External Leg of VPN box connected to DMZ2 of ASA)
I am able to ping 192.168.9.x(VPN Pool IP Address) from the ASA box and hence communication is happening from ASA-->DMZ2-->VPN Box-->DMZ1-->Inside
When i give Access-list outbound permit ip any any
and Access-group outbound in interface outside
I am able to reach the outside System(192.168.6.2) without having nat or pat in place. Other than this command any command with source and destination defined is not working.
Can some one guide me how could i proceed to make sure that only after conneting through the VPN i should be able to access the internet.
