How to override split tunneling per user

[emravnorgeno]

Hi,

I've an ASA 5505, running at ASA 8.2(2). I'm using ASDM 6.2(5).
ASA is set up with Split Tunneling and it works perfectly.
However, for a few users, I want all traffic, including Internet traffic, routed through the ASA.
The spesific users IP address at internet should then be the same as ASA Outside address, not the client local address.
The question is therefore:
How to simple override the split tunneling at user level?
Alternatively set up an "tunnel all" group policy for the specified users?
Any adequate solution at all?

Thanks in advance,

Erik              

[SSCH1NDLER · Accepted solution]

Hallo Erik,

so i would say there missing somethine like :

access-list outside_nat0_outbound extended permit ip 192.168.50.0 255.255.255.128  192.168.1.0 255.255.255.0

nat (outside) 0 access-list outside_nat0_outbound          <-- no nat for communication to inside

nat (outside) 1 192.168.50.0 255.255.255.128               <-- nat the first part of subnet to outside interface ip

Unfortunately i work with IOS 8.3, so there can be some misstakes in the commandline.

[emravnorgeno]

SSCH1NDLER,

Wow! Works perfectly! Thanks a lot.

As an extra option I would like to know if it's possible to set up the "TunnelAll" policy to deny access to the inside resources (hide lan/192.168.1.0)
Combined with the previous settings the "TunnelAll" policy will then be limited to just be host of ASA outside IP.

Thanks,
Erik

[emravnorgeno]

SSCH1NDLER,

Wow! Works perfectly! Thanks a lot.

As an extra option I would like to know if it's possible to set up the "TunnelAll" policy to deny access to the inside resources (hide lan/192.168.1.0)
Combined with the previous settings the "TunnelAll" policy will then be limited to just be host of ASA outside IP.

Thanks,
Erik

[SSCH1NDLER · Accepted solution]

Yeap it is possible.

you can bind an acl how deny traffic to your lan network.

something like:

access-list deny-to-inside permit udp 192.168.50.0 255.255.255.128 192.168.1.0 255.255.255.0 eq 53

access-list deny-to-inside deny ip any 192.168.1.0 255.255.255.0

access-list deny-to-inside permit ip any any

group-policy "RAVtunnel_1 Kopi" attributes

vpn-filter value deny-to-inside

Bye the way you should update your asdm and ios, if possible. Update versions are asa825-33-k8 and asdm 6.49.

[emravnorgeno]

Thanks again,

Everything works perfect!

I've now tree policies, Split, Uturn and TunnelAll. All works different, as wanted. I'm very grateful for all help that got me through this project.

Thank you very much,

Erik