Split tunneling question

[vishnuvichu36601]

We were using a split-tunnelling in our office. So users got office network and internet using their own home network. We need to use office network and internet using the office network.We need to monitor internet traffic also in Cisco ASA of VPN-users.

[Marius Gunnerud · Accepted solution]

Just set up the AnyConnect VPN to tunnel all traffic then configure a dynamic NAT policy for outside to outside for the AnyConnect subnet.  now you should be able to see the connections through the ASA.

[vishnuvichu36601]

nat (outside,outside) source static obj-AnyconnectPool obj-AnyconnectPool destination
 static obj-AnyconnectPool obj-AnyconnectPool

this is the configuration you are talking about?turn off the split-tunelling and tunelling all.????

[Marius Gunnerud]

No that is part of the configuration for hairpinning the VPN traffic out to the internet. in addition to this you need the command same-security-traffic permit intra-interface

For changing the configuration to tunnel-all you would need to change the group-policy configuration

group-policy AnyConnect_GrpPolicy internal

group-policy AnyConnect_GrpPolicy attributes

  split-tunnel-policy tunnelall

tunnel-group AnyConnect type remote-access

tunnel-group AnyConnect general-attributes

  default-group-policy AnyConnect_GrpPolicy

[vishnuvichu36601]

group-policy AnyConnect_GrpPolicy internal

group-policy AnyConnect_GrpPolicy attributes

  split-tunnel-policy tunnelall

tunnel-group AnyConnect type remote-access

tunnel-group AnyConnect general-attributes

  default-group-policy AnyConnect_GrpPolicy

After this we need to write a NAT policy for outside for VPN Network to access internal network and office internet without using Client home ISP

[Marius Gunnerud]

That is correct.  Keep in mind that you also need the command same-security-traffic permit intra-interface

[vishnuvichu36601]

Current senario we configured "same-security-traffic permit inter-interface".Can we configure both in asa same-security-traffic permit inter and intra interface?

Test plan is that.

Create a new group-policy and applied tunnel all and do a dynamic nat for vpn subnet outside outside.Is this step ok for testing???please help

[Marius Gunnerud]

you can have both same-security-traffic permit inter-interface and same-security-traffic permit intra-interface configured at the same time.

Create a new group-policy and applied tunnel all and do a dynamic nat for vpn subnet outside outside.Is this step ok for testing???

Yes, this plus the same-security-traffic permit intra-interface command will allow hairpinning for AnyConnect.