cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
234
Views
5
Helpful
2
Replies
Beginner

Anyconnect clients cannot reach remote S2S NAT-T subnets

Hi to all,

 

i have three interfaces on ASA:

INSIDE (172.16.x.x headquaters)

OUTSIDE (192.168.20 - 40.x - Anyconnect SSL and S2S NAT-T IPsec certificate)

VPNINET (192.168.1 - 15.x - S2S IPsec with static IP)

 

Anyconnect client cannot reach S2S NAT-T IPsec subnets on OUTSIDE interface but subnets S2S IPsec on VPNINET interface are reachable.

From INSIDE i can reach all subnets all subnets can reach INSIDE.

 

I've enabled both:

same-security-traffic permit inter-interface
same-security-traffic permit intra-interface

 

Im trying to find somethink on forum, but still no luck.

 

Thanks a lot.

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Hall of Fame Master

Re: Anyconnect clients cannot reach remote S2S NAT-T subnets

Please check the following:

1. Confirm you are either using tunnelall option or are specifying the problem subnets in your split tunnel ACL for the VPN clients.

2. Either way, you need an outside,outside NAT exemption for the VPN client traffic to the remote subnets

3. The VPN client subnet must be included in the crypto map ACL so that there is an IPsec SA created for VPN subnets to remote subnets.

2 REPLIES 2
Highlighted
Hall of Fame Master

Re: Anyconnect clients cannot reach remote S2S NAT-T subnets

Please check the following:

1. Confirm you are either using tunnelall option or are specifying the problem subnets in your split tunnel ACL for the VPN clients.

2. Either way, you need an outside,outside NAT exemption for the VPN client traffic to the remote subnets

3. The VPN client subnet must be included in the crypto map ACL so that there is an IPsec SA created for VPN subnets to remote subnets.

Beginner

Re: Anyconnect clients cannot reach remote S2S NAT-T subnets

Hi Marvin,

thanks for advice.
Add outside, otside NAT and it works.