anyconnect problem

[Ramirov]

Hello everybody,

I have a follow problem ,  I have an ASA with public IP where I run anyconnect , it working fine ,, but the problem is that my ISP say me that they are seeing my IP PRIVATES in the range public that they give me .

and the ip privates are of my VPN'pools ,. 

Do you have any idea why my ISP see my IP privates ? there is any problem with the anyconnect config??

Thanks.

[Ramirov]

Why routing ??

and not natting?

[Deepak Kumar]

Hi, 

I am not denying to say that there will no issue with NAT but it could be a reason for routing also. That's why I was asked for configuration.

Regards,

Deepak Kumar

[Mohammed al Baqari]

Most likely your internet traffic (or part of it for example dns) is going
over anyconnect tunnel and you aren't natting vpn traffic to go over
internet.

Is it intentional to send internet over anyconnect. If not check your split
acl. Otherwise if you want internet over anyconnect then check your natting

[Ramirov]

Yes, all traffic going over anyconnect , I have a lot of rules of NoNat , maybe some rule is missing , what do you think?

[Mohammed al Baqari · Accepted solution]

In this case check your natting. Clearly you aren't natting the source IP
which is your VPN pool when the traffic is going from AnyConnect to
internet.

You need a nat rule to nat outside,outside. Something like this

nat (outside,outside) source dynamic object_group_vpn_pool interface
no-proxy

or

object network vpn_pool
subnet x.x.x.x x.x.x.x
nat (outside,outside) dynamic interface no-proxy

[Ramirov]

But I have a proxy , and send the parameters of proxy via VPN in group
policy , so then we have a nat rule (DMZ,OUTSIDE)

[Ramirov]

Hello I think I have a problem with no-proxy-arp  because the ISP see my ip private addresses (of VPN's pools) with the mac of my FW , I applied no-proxy-arp in all nat rules but the problem persist.